Filebeat 7.4v does not pick up the index templates provided in filebeat.yml

Elastic Stack Beats
1

Hi Team,

I have recently upgraded filebeat to 7.4v .
I have setup.ilm.enabled: true in filebeat.yml but it does not seem to pick up the index template that i have provided in filebeat.yml, and instead it uses the default index template and index pattern. What configuration should I change or add to make filebeat pickup the templates and patterns that I have provided?

Any help in this regard is appreciated.

2

Could you please share your configuration formatted using </>?

3

Following is the configuration i've used

filebeat.inputs:

  • type: log
    enabled: true
    paths:
  • /es_storage/logstash/logs/logstash-plain.log
    multiline.pattern: '^['
    multiline.negate: true
    multiline.match: after
    #==================== Elasticsearch template setting ==========================
    setup.template.enabled: true
    setup.template.settings:
    index.number_of_shards: 1
    setup.template.name: logstash_logs_template
    setup.template.pattern: test_logs_filebeat_*
    #============================== Kibana =====================================
    setup.kibana:
    host: "https://hostname:5611"

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
hosts: ["https://hostname:9211"]
ssl.certificate_authorities: [""]
index: "test_logs_filebeat_hostname_%{+yyyy.MM.dd}"
username: {USR} password: {PWD}
protocol: "https"

#============================================================================
logging.level: INFO
logging.to_files: true
logging.files:
path: /filebeat/logs/
name: filebeatlogs
keepfiles: 7
permissions: 0600
#============================== X-Pack Monitoring ===============================
xpack.monitoring.enabled: true
#================================= Migration ==================================

This allows to enable 6.7 migration aliases

migration.6_to_7.enabled: true
setup.ilm.enabled: true

4

setup.ilm.enabled: false

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.