Custom index name does not work on metricbeat

Elastic Stack Beats
1

I want to keep the indices for my metricbeats unique per project.
I have added the custom metricbeats as below

Note: running metricbeat 7.2.0 on windows server 2016

###################### Metricbeat Configuration Example #######################  
#==========================  Modules configuration ============================

metricbeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

#==================== Elasticsearch template setting ==========================

setup.template.enabled: true
setup.template.overwrite: true
output.elasticsearch.index: "metricbeat-customname-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "metricbeat-customname"
setup.template.pattern: "metricbeat-customname-*"
#setup.template.fields: "fields.yml"
#setup.dashboards.index: "metricbeat-customname-*"

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  #_source.enabled: false

#================================ General =====================================
#name:
fields:
  hostIp: xxx.xxx.83.36


#============================== Dashboards =====================================
#setup.dashboards.enabled: false
#setup.dashboards.url:

#============================== Kibana =====================================
setup.kibana:
  host: "xxx.xxx.83.21:5601"
#============================= Elastic Cloud ==================================
#cloud.id:
#cloud.auth:
#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  #index: "metricbeat-customname-%{[agent.version]}-%{+yyyy.MM.dd}"
  # Array of hosts to connect to.
  hosts: ["xxx.xxx.83.21:9200"]
  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
#output.logstash:
  # The Logstash hosts
  #hosts: ["localhost:5044"]
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Processors =====================================

# Configure processors to enhance or manipulate events generated by the beat.

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

#================================ Logging =====================================
#logging.level: debug
#logging.selectors: ["*"]

#============================== Xpack Monitoring ===============================
#xpack.monitoring.enabled: false
#xpack.monitoring.elasticsearch:

#================================= Migration ==================================

# This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: true

However, when I start the beat i can see as below in the logs

2019-07-04T21:39:22.737Z	INFO	[index-management]	idxmgmt/std.go:394	Set setup.template.name to '{metricbeat-7.2.0 {now/d}-000001}' as ILM is enabled.
2019-07-04T21:39:22.737Z	INFO	[index-management]	idxmgmt/std.go:399	Set setup.template.pattern to 'metricbeat-7.2.0-*' as ILM is enabled.
2019-07-04T21:39:22.737Z	INFO	[index-management]	idxmgmt/std.go:433	Set settings.index.lifecycle.rollover_alias in template to {metricbeat-7.2.0 {now/d}-000001} as ILM is enabled.
2019-07-04T21:39:22.737Z	INFO	[index-management]	idxmgmt/std.go:437	Set settings.index.lifecycle.name in template to {metricbeat-7.2.0 {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2019-07-04T21:39:22.744Z	INFO	template/load.go:88	Template metricbeat-7.2.0 already exists and will not be overwritten.
2019-07-04T21:39:22.744Z	INFO	[index-management]	idxmgmt/std.go:289	Loaded index template.
2019-07-04T21:39:22.745Z	INFO	[index-management]	idxmgmt/std.go:300	Write alias successfully generated.

It still create the beat as "metricbeat-7.2.0-*"
What am I doing wrong, I don't see an indentation issue here.

2

add this:

setup.ilm.enabled: false

read that:
https://www.elastic.co/guide/en/beats/metricbeat/current/ilm.html
Note the fact that is defaults to enabled and will override your other setup.template settings when its enabled.

1 Like
3

Thanks a lot for the direction @martinr_ubi

Meanwhile, I made it like this,

setup.ilm.enabled: auto
setup.ilm.rollover_alias: "metricbeat-customname"
setup.ilm.pattern: "{now/d}-000001"

if I read it right

#### setup.ilm.enabled

Enables or disables index lifecycle management on any new indices created by Metricbeat. 
Valid values are  `true` ,  `false` , and  `auto` . When  `auto`  (the default) is specified on 
version 7.0 and later, Metricbeat automatically uses index lifecycle management if the feature is 
enabled in Elasticsearch and has the required license; otherwise, Metricbeat creates daily 
indices.

This config will take care of the indices rollover

2 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.