Follow these instructions here (there is a bug in the 8.5. docs)
Ok try this.... this is a complete working sample
This will setup the template and ILM policy with your custom name, where you can control the daily rollover.
Do not try to create a data stream with the -%{+yyyy.MM.dd} syntax ... just go to the new ILM policy and set the rollover daily and the backing index will roll over daily... example in this case
.ds-customname-8.5.3-2023.11.26-000001
The commented-out last line you can uncomment that when you run setup but you MUST comment it back out or it will reload the dashboards every time which takes a very long time and it will look like filebeat is not working ... also on only use that if you plan to reuse a modules dashboards
filebeat.inputs:
- type: filestream
id: syslogs
enabled: true
paths:
- /var/log/system.log
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
output.elasticsearch:
hosts: ["localhost:9200"]
index: "customname-%{[agent.version]}"
setup.template.name: "customname-%{[agent.version]}"
setup.template.pattern: "customname-%{[agent.version]}"
setup.ilm.enabled: true
setup.ilm.policy_name: "customname"
# setup.dashboards.index: "customname-*"
