ELK 7.12 - ILM Rollover - After rollover data keeps being writing old index 000001

Elastic Stack Kibana
4

if you want to pass through
beats->logstash->es
and have all the templates, ILM, pipelines etc work your logstash conf should look like this.
Configure the correct Elasticsearch endpoint and creads.
Do not change the other settings, ILM and Pipelines etc

################################################
# beats->logstash->es default config.
################################################
input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      user => "elastic"
      password => "secret"
    }
  }
}

The general process for this is :slight_smile: if you want to use all the beats functionality but pass through logstash.

  1. You may need to clean up.
  2. Configure your beats / modules how you want.
  3. Point the beats output to elasticsearch and run
    packetbeat setup -e
  4. Then go back into packetbeat.yml and configure the output to logstash, comment out the elasticsearch output.
  5. Start logstash with the conf above
  6. Start packetbeat

When you name the index with the -00001 etc it will never write to the new index etc.