Filebeat loading index template JSON not working

Elastic Stack Beats
1

Hi,

I'm trying to load a custom index template as JSON. This is the filebeat configuration im using:

setup.template.json.enable: true
setup.template.json.path: "index_template_perimeter.json"
setup.template.json.name: "template-perimeter"

setup.template.enabled: false

# Disable automatisch aanmaken van default filebeat ILM
setup.ilm.enabled: false

# Globaal ILM aanlaten
ilm.enabled: true

# Configuratie van de input
filebeat.inputs:
  - type: netflow
    enabled: true
    max_message_size: 10KiB
    host: "xx.xx.xx.xx:2055"
    protocols: v9
    expiration_timeout: 0

# Locatie van de benodigde modules (netflow)
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
  #reload.period: 10s

# Configuratie van de output
output.elasticsearch:
  username: "xxxx"
  password: "xxxx"
  protocol: https
  hosts: ["xxxx:9200", "xxxx:9200", "xxxx:9200"]
  bulk_max_size: 256
  worker: 3
  indices:
    - index: "perimeter"
      when.contains:
        observer.ip: "10.1.254"
output.elasticsearch.ssl.certificate_authorities: ["xxx"]
output.elasticsearch.ssl.certificate: "xxx"
output.elasticsearch.ssl.key: "xxx"

The JSON that im trying to load:

{
  "index_patterns": ["perimeter-*"],                 
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 1,
    "index.lifecycle.name": "ilm-perimeter",      
    "index.lifecycle.rollover_alias": "perimeter"    
  },
  "mappings": {
    "properties": {
          "destination.ip": { "type": "ip" },
          "netflow.destination_ipv4_address": { "type": "ip" },
          "netflow.post_nat_destination_ipv4_address": { "type": "ip" },
          "netflow.post_nat_source_ipv4_address": { "type": "ip" },
          "netflow.source_ipv4_address": { "type": "ip" },
          "observer.ip": { "type": "ip" },
          "source.ip": { "type": "ip" },
          "destination.bytes": { "type": "byte" },                   
          "network.bytes": { "type": "byte" },                   
          "source.bytes": { "type": "byte" }                          
    }
  }
}

Im wondering does the setup.template.enabled: false option must be enabled to load a custom JSON template? Because when i enable it it just loads the default filebeat-7.6.2- template and not my custom one. When i set the option to false it also never loads my custom template.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.