Datastream behavior in filebeat?

Elastic Stack Beats
4

No... it is because you set the index name like this
index: voucher-app-logs-%{[agent.version]}-%{+yyyy.MM.dd}
..........................................^^^^^^^^^^^^^^^ <!- THIS is not correct

That says create a new datastream every day....

Set the index as I suggested and it will not

If you do not set the index name at all it will create a datastream

filebeat-8.7.0 no daily date

Filebeat does not create a data stream per day by default, its is doing it because you configured it to it.

Try what I suggested first... your understanding is not correct

index: voucher-app-logs-%{[agent.version]}

THEN you can control how often the underlying .ds-.... is created with the ILM policy

1 Like