Hi guys, I am setting my filebeat.yml in order to send logs to Elasticsearch. I created a template in Elasticsearch, I named it: filebeat . See below the configuration. I set the filebeat.yml as you guys can see below. The issue is that filebeat keeps creating index like this: filebeat-7.1.1-202…

ILM configuration doesn't create an index per day by default in Filebeat, it creates one new index when one of this happens: Current index is more than 30 days old Current index takes more than 50GB This uses to be a sane default for most of the cases. It is not recommended to have very big index…

Custom filebeat index - same index name but diferent template

Elastic Stack Beats

bueka.torao (Bueká Torao) March 2, 2020, 3:26pm 4

I solved it using this configuration, I don´t know if it is the best configuration.

#==================== Elasticsearch template setting ==========================

setup.template.settings:
name: "filebeat"
pattern: "filebeat-*"
enable: false

setup.ilm.enabled: true
setup.ilm.pattern: "{now/M-1M{yyyy.MM}}"

Topic		Replies	Views
Create Index with filebeat Beats filebeat	15	12267	February 22, 2020
Filebat - Create a custom index on elasticsearch Beats filebeat	14	4789	October 23, 2019
Index filebeat-7.8.1 gets created automatically Elasticsearch ilm-index-lifecycle-management	5	586	December 7, 2020
Massive index creation after conditional indexing Beats docker , filebeat	12	475	June 4, 2024
How to create a single index when using with filebeats Beats filebeat	5	1495	June 16, 2017

Custom filebeat index - same index name but diferent template

Related topics