Disable automatic creation of daily indexes

Elastic Stack Beats
1

Hey all,

I recently created custom index names because I needed spaces for customers, and each customer needed an index to link to the space. So that's what I did. I have these indexes now.

  • auditbeat-customer1-01/01/2000

  • filebeat--customer1-01/01/2000

  • metricbeat-customer1-01/01/2000

  • auditbeat-customer2-01/01/2000

  • filebeat--customer2-01/01/2000

  • metricbeat-customer2-01/01/2000

Previously, my indexes would have stayed open until they reached 50GB.
Now a new index is created every day for each beat. So I am getting new indexes every day, which I rather don't. I'd like to keep the same index until it reaches 50GB.
But I have no idea on how to do this. Any ideas?

Below is the config of my beats.yml
#=============================== Index management =============================
setup.ilm.enabled: false

output.elasticsearch.index: "auditbeat-customer1-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "auditbeat-customer1"
setup.template.pattern: "auditbeat-customer1-"
setup.dashboards.index: "auditbeat-customer1-"

2

You need to use ILM to do this. You can specify custom index names though.

4

How do I do this? Thanks for the quick reply!

5

https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html, and the other beats have similar pages :slight_smile:

6

So, does it mean that if I set ilm.enabled to auto, I can use custom index names and use my policy?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.