I've tested lately filebeat 7.0.0. but coudn't get it to work with my elasticsearch-cluster (also version 7.0.0). Whenever I used the appropiate way to change the index name: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html
First I had to disable ILM which isn't stated anywhere and after this data is incoming into ES under my newly created Index. Unfortunatly the data isn't complete, because all fields are missing...
FYI: I use the system-module to collect syslog and auth logs.
I would like to hear If anyone use this type of configuration and can help out with some configuration snippets, or help troubleshooting.
I downgraded my whole Infrastructure back to 6.7.1 and it is now working fine. Fields missing means, that the data was visible through kibana but only the timestamps, no other fields where inserted. I just had the @timestamp field.
I've tried to insert the template manually but this didn't solve my problem. Personally for me it is very hard to get around what ILM is doing. I get the point from the documentation, but I coudn't get the point how ILM is connecting my costum-named-template to an exsisting ILM-Policy? Is it actually doing this? Or just ignoring the ILM-Polcy if I already have inserted the defaut one? How can I change the name of the default policy? So many questions...
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.