Filebat - Create a custom index on elasticsearch

Elastic Stack Beats
1

Please someone here understand what is happen with my config, my filebeat doenst create index with my custom name. When i run the command filebeat setup the filebeat communicate with my elastic and create a index default filebeat.

filebeat.inputs:

  • type: log
    enabled: true
    paths:
    • /var/log/*.log

setup.template.enabled: false
setup.template.name: 'srvprod_beat'
setup.template.pattern: 'srvprod_beat-*'

output.elasticsearch:
hosts: ["srvelastic:9200"]
username: "user-elastic"
password: "MyPassWord"
index: 'srvprod_beat-%{[agent.version]}-%{+dd.MM.yyyy}'

My filebeat, elastic-cluster, kibana is 7.3 all Linux.

2

Even I too face similar issue, is there any better documentation or anyone who can help on setting a custom index name?

3

I have the same issue. Did you fix it yet? :roll_eyes:

If you don't specify either an index template name nor its pattern name, you'll get an error (see below), but even if you do, the default template filebeat-7.3.1 is still getting loaded, :thinking: why!

Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified

4

If i mention setup.template.name and setup.template.pattern i dont get any error but still my index name remains filebeat-version-date.

5

Add the following configuration to filebeat
setup.ilm.enabled: false

2 Likes
6

This line totally did the trick! Thanks!

7

@Anantha_Padmanabhan It's not that, I had that setup already. It was setup.ilm.enabled: false

8

@Anantha_Padmanabhan, it's a known issue

9

Yep I did this but when you disable the ILM your filebeat doesn't auto create Lifecycle policy.

10

yeah i too fixed it by doing the same temporarily..

11

It's an open issue since April, 2019.

12

@daniel_a Please use

.\filebeat.exe setup --index-management

This will set the index.

13

@abhishek_kumar3 Do I still need to include setup.ilm.enabled: false? If not, this would solve the issue I think with not having ILM enabled, right?

14

@daniel_a Yes, ilm is required once while setting up the index in the elastic search I think. For sending the data to a different index pattern, you may use that command I mentioned.

15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.