stephenb
(Stephen Brown)
December 10, 2023, 11:06pm
4
These are not indented correctly and there is a error in 7.17 docs.... the 8.11 docs are correct
These need to be all the way to the left / no indent
output.elasticsearch.index: "customname-%{[agent.version]}"
setup.template.name: "customname-%{[agent.version]}"
setup.template.pattern: "customname-%{[agent.version]}"
Also if you are not using logstash then those configuration do no matter...
If later you want to "passthrough " logstash then we can get that right
I think I went to through this in a little more detail here
Follow these instructions here (there is a bug in the 8.5. docs)
Ok try this.... this is a complete working sample
This will setup the template and ILM policy with your custom name, where you can control the daily rollover.
Do not try to create a data stream with the -%{+yyyy.MM.dd} syntax ... just go to the new ILM policy and set the rollover daily and the backing index will roll over daily... example in this case
.ds-customname-8.5.3-2023.11.26-000001
The commented-out last line you can u…