Filebeat Autogenerating Index Name When I Specified: sample-%

Elastic Stack Beats
1

I have specified the index in my filebeat.yml as sample-%{+YYY.MM.dd} but when I check my indices via /_cat/indices?vmyindexlooks like a some form of autogenerated name like:filebeat-7.5.2-2020.02.12-000001`

# setup filebeat to send output to elasticsearch
output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  index: "sample-%{+YYYY.MM.dd}"
  
setup.template.name: "sample"
setup.template.pattern: "sample-*"

Can someone please explain to me why this is happening. I would preferably have a predefined index name as opposed to the one above.

1 Like
2

This is probably caused by ILM (index lifecycle management), which overrides the output-level index settings. If you don't want Filebeat to manage your indices, you should include setup.ilm.enabled: false. If you want to keep using ILM but change the name, you probably want to set setup.ilm.rollover_alias (see the previous link for details).

As a general warning, though, it's usually best to start the index name with filebeat even if you customize it (e.g. filebeat-sample would be fine) because a lot of the automatic settings expect it.

1 Like
3

Thank you. Is that in the Filebeat.yml or the configuration? I’m using the containerised ELK in my case.

4

The ILM settings should be in filebeat.yml, yes.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.