Filebeat 8.17.10 disable template data_stream

Elastic Observability Logs
1

Hi

I have filebae version 8.17.10 running on k8s

And send logs to elasticsearch with the same version

This is my configuration

filebeat:
inputs:

  • type: filestream
    id: vouchers-logs-stream
    paths:
    • /path/to/logs/*.log
      json:
      keys_under_root: true
      add_error_key: true
      overwrite_keys: true
      message_key: message
      parsers:
    • ndjson:
      target: ""
      add_error_key: true
      output:
      elasticsearch:
      hosts: [ "..." ]
      username: "..."
      password: "..."
      index: voucher-app-logs-%{[agent.version]}-%{+yyyy.MM.dd}
      setup:
      template:
      name: "voucher-app-logs"
      pattern: "voucher-app-logs*"
      overwrite: false
      ilm:
      enabled: true
      policy_name: "voucher-app-logs-lifecycle-policy"

When I start it I see in kibana index management the created template enabled data stream i want to disable it can i do it from filebeat configuration not from kibana ?

2

Hi @almteref

I don't think you can do exactly what you want to do through filebeat, if I understand you wanted filebeat to generate the template, but you want to change the data stream setting. I don't think you can do that..

You can load your own template if you like see here