Exporting to constant index name with Filebeat

Elastic Stack Beats
#1

From the documentation on changing the name of the index that filebeat writes to:

image
image940×442 58.9 KB

But I was wondering if it would be possible to have filebeat write to an index name that doesn't change:

output.elasticsearch.index: "my-custom-index"
setup.template.name": "my-custom-index"
setup.template.pattern": "my-custom-index"

Would this work? Would there be any adverse consequences of doing this?
I've tried setting these fields in my filebeat.yml, but the output is still being written to the filebeat-7.11.1* indexes...

If I can get this to work, I plan on hooking that index into a data stream.

#2

I figured out how to do it:

simply add setup.ilm.enabled: false to filebeat.yml and it will start writing to whatever index you say!

#3

After the ilm.enabled change you'll find it most definitely does work. You may need to manually set up index lifecycle management if you're wanting to use it, but otherwise I'm not sure there's any significant adverse consequences.

#4

Thanks! Yes, I plan on setting up an index template that has the ILM policies in place.