So turnoff ILM or not ? I added what @rugenl wrote but nothing change.
output.elasticsearch
hosts: ["xxxxx"]
username: "xxx"
password: "xxx"
index: "filebeat-%{[host.name]}-elastic-internal-%{+yyyy.MM.dd}"
setup.ilm.rollover_alias: "filebeat-%{[host.name]}-elastic-internal"