Filebeat upgrade from 6.8 to 7.6 index issue

I am having an issue using my 6.8 yml file with 7.6.
The index that I am using in the yml file is not carrying into Elasticsearch as it looks like it is using ILM to specify the index.

Do I need to add anything to my YML to stop it using ILM?

My yml…

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - XXX\filebeats-WDog-DailyStats*.csv
  fields:
   type: "ec_stats_daily"
  exclude_lines: ['^Project']

- type: log
  enabled: true
  paths:
    - XXX\filebeats-WDog-MonthlyStats*.csv
  fields:
   type: "ec_stats_monthly"
  exclude_lines: ['^Project']

- type: log
  enabled: true
  paths:
    - XXX\filebeats-WDog-ECDailyTableSize*.csv
  fields:
   type: "ec_stats_tablesize"
  exclude_lines: ['^Project']

- type: log
  enabled: true
  paths:
    - XXX\filebeats-WDog-DailyConcurrencyStats*.csv
  fields:
   type: "ec_stats_concurrency"
  exclude_lines: ['^Project']

- type: log
  enabled: true
  paths:
    - XXX\filebeats-WDog-SQLJobStatus*.csv
  fields:
   type: "ec_stats_sqljobs"
  exclude_lines: ['^Project']
  
- type: log
  enabled: true
  paths:
    - XXX\filebeats-Testing-Summary-CI*.csv
  fields:
   type: "selenium_summary"
  exclude_lines: ['^Project']
  
- type: log
  enabled: true
  paths:
    - XXX\filebeats-Testing-Details-CI*.csv
  fields:
   type: "selenium_details"
  exclude_lines: ['^Project']
  
- type: log
  enabled: true
  paths:
    - XXX\filebeats-WDog-ECSessionLog*.csv
  fields:
   type: "ecsessionlog"
  exclude_lines: ['^Project']

- type: log
  enabled: true
  paths:
    - XXX\filebeats-WDog-ECSession-*.csv
  fields:
   type: "ecsession"
  exclude_lines: ['^Project']

- type: log
  enabled: true
  paths:
    - XXX\filebeats-WDog-EPLogMsg-*.csv
  fields:
   type: "eplogmsg"
  exclude_lines: ['^Project']

#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s
  


#==================== Elasticsearch template setting ==========================

setup.template.enabled: true
setup.template.name: "filebeat-ecstats"
setup.template.pattern: "filebeat-*"
setup.template.settings:
    index.number_of_shards: 1
#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  #host: "localhost:5601"

#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.



#=========================== Local Queue =============================
  
 queue.mem:
   events: 4096
   flush.min_events: 512
   flush.timeout: 5s

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  hosts: ["localhost:9200"]





  # Optional protocol and basic auth credentials.
  protocol: "http"

  index: "filebeat-%{[fields.type]:MissingType}-TEST-%{+YYYY}"

  pipelines:
    - pipeline: "ECStats_Daily"
      when.equals:
        fields.type: "ec_stats_daily"
    - pipeline: "ECStats_Monthly"
      when.equals:
        fields.type: "ec_stats_monthly"
    - pipeline: "ECStats_TableSize"
      when.equals:
        fields.type: "ec_stats_tablesize"
    - pipeline: "ECStats_Concurrency"
      when.equals:
        fields.type: "ec_stats_concurrency"
    - pipeline: "ECStats_SQLJobs"
      when.equals:
        fields.type: "ec_stats_sqljobs"
    - pipeline: "SeleniumSummary"
      when.equals:
        fields.type: "selenium_summary"
    - pipeline: "SeleniumDetails"
      when.equals:
        fields.type: "selenium_details"
    - pipeline: "tblECSessionlog"
      when.equals:
        fields.type: "ecsessionlog"
    - pipeline: "tblECSession"
      when.equals:
        fields.type: "ecsession"
    - pipeline: "tblEPLogMsg"
      when.equals:
        fields.type: "eplogmsg"

Yes, you probably want setup.ilm.enabled: false. This was the default up until 7.0.0, at which point it switched to auto. You can read more about this at https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html.

Shaunak

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.