Elastic 7.10.2: no way to automatically create the first index. Manually kickstart ILM still mandatory?

Dear experts,
I am running Elastic 7.10.2. I would like to manage a first index with syntax filebeat-7.10.2-postfix-2021.03.10-000001. Thanks to ILM rollover mechanism next one would be filebeat-7.10.2-postfix-2021.03.10-000002 ...

Unfortunately, the first created index name is filebeat-7.10.2-postfix .... as it should be the alias name instead. I thought it was not needed anymore to kickstart ILM, by manually creating the first index in version 7.10.2 ?

All your support and inputs highly appreciated.

Here is my filebeat configuration extract:

setup.ilm.enabled: true
setup.ilm.rollover_alias: 'filebeat-%{[agent.version]}-postfix'
setup.ilm.pattern: "{now/d{yyyy.MM.dd}}-000001"
setup.ilm.policy_name: "datastream_policy_30d"
setup.ilm.check_exists: true
setup.ilm.overwrite: false

Here are the filebeat log outputs regarding ILM:

2021-03-10T14:06:50.898+0100    INFO    [index-management]      idxmgmt/std.go:261      Auto ILM enable success.
2021-03-10T14:06:50.900+0100    INFO    [index-management.ilm]  ilm/std.go:139  do not generate ilm policy: exists=true, overwrite=false
2021-03-10T14:06:50.900+0100    INFO    [index-management]      idxmgmt/std.go:274      ILM policy successfully loaded.
2021-03-10T14:06:50.900+0100    INFO    [index-management]      idxmgmt/std.go:407      Set setup.template.name to '{filebeat-7.10.2-postfix {now/d{yyyy.MM.dd}}-000001}' as ILM is enabled.
2021-03-10T14:06:50.900+0100    INFO    [index-management]      idxmgmt/std.go:412      Set setup.template.pattern to 'filebeat-7.10.2-postfix-*' as ILM is enabled.
2021-03-10T14:06:50.900+0100    INFO    [index-management]      idxmgmt/std.go:446      Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.10.2-postfix {now/d{yyyy.MM.dd}}-000001} as ILM is enabled.
2021-03-10T14:06:50.900+0100    INFO    [index-management]      idxmgmt/std.go:450      Set settings.index.lifecycle.name in template to {datastream_policy_30d {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2021-03-10T14:06:52.418+0100    INFO    template/load.go:117    Try loading template filebeat-7.10.2-postfix to Elasticsearch
2021-03-10T14:06:52.582+0100    INFO    template/load.go:109    template with name 'filebeat-7.10.2-postfix' loaded.
2021-03-10T14:06:52.582+0100    INFO    [index-management]      idxmgmt/std.go:298      Loaded index template.
2021-03-10T14:06:52.616+0100    INFO    [index-management]      idxmgmt/std.go:307      Write alias exists already
2021-03-10T14:06:52.616+0100    INFO    [publisher_pipeline_output]     pipeline/output.go:151  Connection to backoff(elasticsearch(http://elasticsearch.service.webcom:9200)) established

I updated setup.ilm.rollover_alias with value 'fbeat-%{[agent.version]}-postfix' in order to avoid an extra matching with the default filebeat legacy template
Then, fbeat-7.10.2-postfix-2021.03.10-000001is automatically kickstarted

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.