Filebeat does not create daily indices into elasticsearch automatically

Elastic Stack Beats
1

filebeat does not create daily indices into elasticsearch automatically.
for example I have to manually create a indice like filebeat-2017.04.24, with this, filebeat can then auto harvest and dump logs.

if no indice is there today, the following error shows up:
2017/04/24 02:58:07.022131 output.go:109: DBG output worker: publish 10 events
2017/04/24 02:58:07.024207 client.go:658: INFO Connected to Elasticsearch version 5.3.0
2017/04/24 02:58:07.024242 output.go:301: INFO Trying to load template for client: http://localhost:9200
2017/04/24 02:58:07.024668 output.go:322: INFO Template already exists and will not be overwritten.
2017/04/24 02:58:07.026254 client.go:250: ERR Failed to perform any bulk index operations: 404 Not Found
2017/04/24 02:58:07.026271 single.go:91: INFO Error publishing events (retrying): 404 Not Found
2017/04/24 02:58:08.027925 client.go:658: INFO Connected to Elasticsearch version 5.3.0
2017/04/24 02:58:08.027958 output.go:301: INFO Trying to load template for client: http://localhost:9200
2017/04/24 02:58:08.028454 output.go:322: INFO Template already exists and will not be overwritten.
2017/04/24 02:58:08.030287 client.go:250: ERR Failed to perform any bulk index operations: 404 Not Found
2017/04/24 02:58:08.030305 single.go:91: INFO Error publishing events (retrying): 404 Not Found

stack & environment:
filebeat => elasticsearch => kibana (with x-pack)
elasticsearch version 5.3.0
filebeat version 5.3.1 (amd64), libbeat 5.3.1

config:

es.png745×73 7.76 KB

2

What version of things are you using?
What does your config look like?

4

Hi warkolm, thanks for ur reply, I revised the original post.

[update: resolved]
the solution is to append ,filebeat* to the action.auto_create_index option in elasticsearch.yml
I recommend the editor to revise the following wiki to add a note or directly append filebeat and logstash for the convenience of future readers.
https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html

5

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.