Filebeat - Unable to change indice name & disable ILM

Hi, I recently started to use ELK with Filebeat version 7.13.0.
I'm trying to change the default indice name that Filebeat is creating:


and also disabling the ILM policy for the created indice.
No matter what I change in filebeat.yml, I can't manage to get it working.
This is my current filebeat.yml config:


============================== Filebeat inputs ===============================


  • type: log
    enabled: true
    • /var/log/nginx/access.log*
      exclude_files: ['.gz$']

============================== Filebeat modules ==============================

path: ${path.config}/modules.d/*.yml
reload.enabled: false

======================= Elasticsearch template setting =======================

index.number_of_shards: 1

=================================== Kibana ===================================

host: "myhost:5601"

================================== Outputs ===================================

---------------------------- Elasticsearch Output ----------------------------

hosts: ["myhost:9200"]
pipeline: filebeat-7.13.0-nginx-access-pipeline

================================= Processors =================================


  • add_host_metadata:
    when.not.contains.tags: forwarded
  • add_cloud_metadata: ~
  • add_docker_metadata: ~
  • add_kubernetes_metadata: ~

I tried to put the following lines in my config but nothing helps, It's like being ignored or something.
output.elasticsearch.index: "customname-%{[agent.version]}-%{+yyyy.MM.dd}" "customname"
setup.template.pattern: "customname-*"
index: "customname-%{+yyyy.MM.dd}"
output.elasticsearch.index: "customname-%{+yyyy.MM.dd}"
setup.ilm.enabled: false


1 Like

i would suggest you to create the custom index using command

curl -H "Content-Type: application/json" -XPUT -u elasticusername/password elasticURL:9200/CUSTOMINDEX

by this comment you can create the index

now in kibana go to index template and add filebeat template with your index -Mapping

Welcome to our community! :smiley:

Can you elaborate more on what you mean by not working? What is happening?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.