Yes, im deploying on Kubernetes cluster, my bad to not point it out in the beginning.
so, i try to add the index field, and addition to that i add
setup.template.name and setup.template.pattern also (based on this docs https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es)
- type: kubernetes
but after i re deploying my cluster, i still not seeing my 30th July (today) index..
*ignore the face that it has 28 and 29 July, its created by ILM
you mentioning about 50GB index size, is ILM what you means? if thats what you mean, i did try that, but since my cluster only live for office hours, the lifetime of an index is not 24 hours, so when i try ILM with 1 day Max age, it wont generate new index in the next day (since the cluster age is not 24 hours yet).
so, is filebeat creating new index based on ILM only, or its creating new index by output configuration? since if its ILM, then i dont have any way to create it every dat then