Filebeat - logstash new indexs are created without template

Elastic Stack Logstash
1

Hi Everybody,

I'm trying to use Logstash for all my filebeat nodes with ILM enabled and with ingest-pipelines.

New indexes are created as 'filebeat-7.4.2' but where is no ILM enabled. - It looks like the indexes not are created with the filebeat-7.4.2 template in elasticsearch since the index also only have 1 shard.

My logstash elasticsearch output config:

elasticsearch {
hosts => "http://elastic-logs-1:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}"
pipeline => "%{[@metadata][pipeline]}"
sniffing => true
}

Does anybody have an idea of what i'm missing regarding this?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.