Filebeat 7.5.1 Missing a step for custom index names config?

Elastic Stack Beats
1

I have the following set it my filebeat.yml config file, which should allow me to see dev-* index in kibana. However these are still showing as filebeat-*. Is there something Im missing based on the docs and the reference file on install I should have everything set correctly.

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/*.log

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

output.elasticsearch:
  hosts: ["my_es_host_ip:9200"]
  index: "dev-%{[agent.version]}-%{+yyyy.MM.dd}"

setup.template.enabled: true
setup.template.name: "dev-%{[agent.version]}"
setup.template.pattern: "dev-%{[agent.version]}-*"

Thanks

2

Yes, this is unfortunately not obvious in our docs (see https://github.com/elastic/beats/issues/11866) :disappointed:. You will need to add an extra setting:

setup.ilm.enabled: false

By default this setting is set to true and in that case the default index template and index names stay in effect.

1 Like
3

That fixed did it :boom:, thanks for the help!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.