Dear experts,
I am running Elastic 7.10.2. I would like to manage a first index with syntax filebeat-7.10.2-postfix-2021.03.10-000001. Thanks to ILM rollover mechanism next one would be filebeat-7.10.2-postfix-2021.03.10-000002 ...
Unfortunately, the first created index name is filebeat-7.10.2-postfix .... as it should be the alias name instead. I thought it was not needed anymore to kickstart ILM, by manually creating the first index in version 7.10.2 ?
All your support and inputs highly appreciated.
Here is my filebeat configuration extract:
setup.ilm.enabled: true
setup.ilm.rollover_alias: 'filebeat-%{[agent.version]}-postfix'
setup.ilm.pattern: "{now/d{yyyy.MM.dd}}-000001"
setup.ilm.policy_name: "datastream_policy_30d"
setup.ilm.check_exists: true
setup.ilm.overwrite: false
Here are the filebeat log outputs regarding ILM:
2021-03-10T14:06:50.898+0100 INFO [index-management] idxmgmt/std.go:261 Auto ILM enable success.
2021-03-10T14:06:50.900+0100 INFO [index-management.ilm] ilm/std.go:139 do not generate ilm policy: exists=true, overwrite=false
2021-03-10T14:06:50.900+0100 INFO [index-management] idxmgmt/std.go:274 ILM policy successfully loaded.
2021-03-10T14:06:50.900+0100 INFO [index-management] idxmgmt/std.go:407 Set setup.template.name to '{filebeat-7.10.2-postfix {now/d{yyyy.MM.dd}}-000001}' as ILM is enabled.
2021-03-10T14:06:50.900+0100 INFO [index-management] idxmgmt/std.go:412 Set setup.template.pattern to 'filebeat-7.10.2-postfix-*' as ILM is enabled.
2021-03-10T14:06:50.900+0100 INFO [index-management] idxmgmt/std.go:446 Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.10.2-postfix {now/d{yyyy.MM.dd}}-000001} as ILM is enabled.
2021-03-10T14:06:50.900+0100 INFO [index-management] idxmgmt/std.go:450 Set settings.index.lifecycle.name in template to {datastream_policy_30d {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2021-03-10T14:06:52.418+0100 INFO template/load.go:117 Try loading template filebeat-7.10.2-postfix to Elasticsearch
2021-03-10T14:06:52.582+0100 INFO template/load.go:109 template with name 'filebeat-7.10.2-postfix' loaded.
2021-03-10T14:06:52.582+0100 INFO [index-management] idxmgmt/std.go:298 Loaded index template.
2021-03-10T14:06:52.616+0100 INFO [index-management] idxmgmt/std.go:307 Write alias exists already
2021-03-10T14:06:52.616+0100 INFO [publisher_pipeline_output] pipeline/output.go:151 Connection to backoff(elasticsearch(http://elasticsearch.service.webcom:9200)) established