Hi, I recently started to use ELK with Filebeat version 7.13.0.
I'm trying to change the default indice name that Filebeat is creating:
"filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
and also disabling the ILM policy for the created indice.
No matter what I change in filebeat.yml, I can't manage to get it working.
This is my current filebeat.yml config:
filebeat.yml
============================== Filebeat inputs ===============================
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/access.log*
exclude_files: ['.gz$']============================== Filebeat modules ==============================
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false======================= Elasticsearch template setting =======================
setup.template.settings:
index.number_of_shards: 1=================================== Kibana ===================================
setup.kibana:
host: "myhost:5601"================================== Outputs ===================================
---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
hosts: ["myhost:9200"]
pipeline: filebeat-7.13.0-nginx-access-pipeline================================= Processors =================================
processors:
- add_host_metadata:
when.not.contains.tags: forwarded- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
I tried to put the following lines in my config but nothing helps, It's like being ignored or something.
output.elasticsearch.index: "customname-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "customname"
setup.template.pattern: "customname-*"
index: "customname-%{+yyyy.MM.dd}"
output.elasticsearch.index: "customname-%{+yyyy.MM.dd}"
setup.ilm.enabled: false
Thanks!
