Filebeat re-ingesting old logs after pod restart (ECK on GKE) - ignore_older not working

Elastic Orchestration Elastic Cloud on Kubernetes (ECK)
1

Problem

Filebeat is repeatedly re-ingesting old logs (4-15 days old) causing previously deleted indices to be recreated.
Environment

  • Filebeat version: 7.10.1

  • ADeployment: ECK (Elastic Cloud on Kubernetes) DaemonSet

  • Platform: Google Kubernetes Engine (GKE)

  • Number of pods: 42 DaemonSet pods

  • Elasticsearch version: 7.10.1s happens periodically, and we need to configure

What's Happening

  1. Idelete old filebeat indices (e.g., filebeat-7.10.1-2025.12.10 through date 2025.12.16)

  2. Within hours, these indices are recreated with old log data

  3. The recreated indices contain logs with:

    • @timestamp: Dec 12-16, 2025 (original log timestamp)

    • event.ingested: Jan 1, 2026 (today - when re-indexed)

      How to Solve this ?

2

Hello @Marwan_Ghonem

Welcome to the Community!!

Could you please share the filebeat.yml in order to understand why the older indices are created again?

It can be related to the registry path :

Similar older issue :

Thanks!!

3

Hi @Marwan_Ghonem

In addition 7.10.is 5+ years old and that you should upgrade with a matter of urgency.

Many improvements have been made on filebeat, including many improvements directly targeted at K8s container logs.