Filebeat - Unable to change indice name & disable ILM

Elastic Stack Beats
,
1

Hi, I recently started to use ELK with Filebeat version 7.13.0.
I'm trying to change the default indice name that Filebeat is creating:

"filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

and also disabling the ILM policy for the created indice.
No matter what I change in filebeat.yml, I can't manage to get it working.
This is my current filebeat.yml config:

filebeat.yml

============================== Filebeat inputs ===============================

filebeat.inputs:

  • type: log
    enabled: true
    paths:
    • /var/log/nginx/access.log*
      exclude_files: ['.gz$']

============================== Filebeat modules ==============================

filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false

======================= Elasticsearch template setting =======================

setup.template.settings:
index.number_of_shards: 1

=================================== Kibana ===================================

setup.kibana:
host: "myhost:5601"

================================== Outputs ===================================

---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:
hosts: ["myhost:9200"]
pipeline: filebeat-7.13.0-nginx-access-pipeline

================================= Processors =================================

processors:

  • add_host_metadata:
    when.not.contains.tags: forwarded
  • add_cloud_metadata: ~
  • add_docker_metadata: ~
  • add_kubernetes_metadata: ~

I tried to put the following lines in my config but nothing helps, It's like being ignored or something.
output.elasticsearch.index: "customname-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "customname"
setup.template.pattern: "customname-*"
index: "customname-%{+yyyy.MM.dd}"
output.elasticsearch.index: "customname-%{+yyyy.MM.dd}"
setup.ilm.enabled: false

Thanks!

1 Like
2

i would suggest you to create the custom index using command

curl -H "Content-Type: application/json" -XPUT -u elasticusername/password elasticURL:9200/CUSTOMINDEX

by this comment you can create the index

now in kibana go to index template and add filebeat template with your index -Mapping

3

Welcome to our community! :smiley:

Can you elaborate more on what you mean by not working? What is happening?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.