Custom metricbeat index,ilm

[elasticforme (Sachin)]

I have follwing setting on metricbeat.yml

setup.template.enabled: true
setup.template.overwrite: true

output.elasticsearch.index: "hou_metricbeat_insite-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "hou_metricbeat_insite"
setup.template.pattern: "hou_metricbeat_insite-*"
setup.template.fields: "fields.yml"

setup.ilm.enabled: auto
setup.ilm.rollover_alias: "hou_metricbeat_insite"
setup.ilm.pattern: "{now/d}-000001"

it does create index called hou_metricbeat_insite-{date} no agent.version there.

I even try %{agent.version} but no luck.

it does creates index, and ILM policy. but without agent.version

[warkolm (Mark Walkom)]

@elasticforme

output.elasticsearch.index: "hou_metricbeat_insite-%{[agent.version]}-%{+yyyy.MM.dd}"

and

@elasticforme

setup.ilm.rollover_alias: "hou_metricbeat_insite"

Don't align. If you want to use ILM then you need to write directly to the alias and then let ILM create the underlying index name.

[elasticforme (Sachin)]

alright use this and it worked. I just have to create ilm policy and link with index.

setup.template.enabled: true
setup.template.overwrite: true
output.elasticsearch.index: "metricbeat_insite-*"
setup.template.name: "metricbeat_insite"
setup.template.pattern: "metricbeat_insite-*"

setup.template.fields: "/etc/metricbeat/fields.yml"
setup.ilm.overwrite: true
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "metricbeat_insite-%{[agent.version]}"
setup.ilm.pattern: "{now/d}-000001"

and I guess I can now disable setup.templae.overwrite. to avoide overwriting anything at next restart