# For anyone struggling in changing the index name of your beats, I've got a solution finally **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [July 12, 2019, 8:58am UTC](https://discuss.elastic.co/t/for-anyone-struggling-in-changing-the-index-name-of-your-beats-ive-got-a-solution-finally/190176 "2019-07-12T08:58:03Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Choosue](https://avatars.discourse-cdn.com/v4/letter/c/b5ac83/32.png) [@Choosue](https://discuss.elastic.co/u/Choosue)\ **Post date:** [July 12, 2019, 8:58am UTC](https://discuss.elastic.co/t/for-anyone-struggling-in-changing-the-index-name-of-your-beats-ive-got-a-solution-finally/190176/1 "2019-07-12T08:58:04Z")
# First of all My elasticsearch version: 7.2.0 My kibana version: not important but it is 7.2.0 My packetbeat version: 8.0.0 ([current master branch](https://github.com/elastic/beats/commit/6ed288436e3ab3f54b4b00c8d05b7be28aaab8ce)) Since my goal is to adding new features to packetbeat, so I downloaded the stable version of es and kibana. # What I want I've got two packetbeats capturing different network interfaces, say `packetbeat1` capturing `enp1s0f0` and `packetbeat2` capturing `enp1s0f1`. I want to use my **customized index name** to seperate them, say `packetbeat1-%{[agent.version]}-%{+yyyy.MM.dd}` for `packetbeat1` and `packetbeat2-%{[agent.version]}-%{+yyyy.MM.dd}` for `packetbeat2` # What I did I followed the [official guide](https://www.elastic.co/guide/en/beats/packetbeat/master/packetbeat-template.html), made some changes to my `packetbeat.yml` file by adding these lines: ```auto # packetbeat.yml for "packetbeat1" output.elasticsearch.index: "packetbeat1-%{[agent.version]}-%{+yyyy.MM.dd}" setup.template.name: "packetbeat1" setup.template.pattern: "packetbeat1-*" ``` Then, I restarted my packetbeat. # What I expect I expected my elasticsearch to be added a new index named `packetbeat1`. # What I got The ouput of `curl -X GET "localhost:9200/_cat/indices?v"` was still (columns after `index` is ignored by me for simplicity): ```bash health status index ... yellow open packetbeat-8.0.0-2019.07.12-000001 ... ``` # After all these I've searched the entire elastic discuss forum, checked almost every link from my top 3 Google search pages. **Nothing** helpful! So I turned to the hard-core method: read the f\*\*king code. For all the clues I got, only the ouput log from `./packetbeat test config -e` inspired me: ```bash [index-management] idxmgmt/std.go:178 Set output.elasticsearch.index to 'packetbeat-8.0.0' as ILM is enabled. ``` What?! I told you to set the index name as `packetbeat1` in the config file, and you still setting it as `packetbeat-8.0.0`? Let's reveal the code related: ```auto # package github.com/elastic/beats/libbeat/idxmgmt 174 var alias string 175 mode := s.ilm.Mode() 176 if mode != ilm.ModeDisabled { 177 alias = s.ilm.Alias().Name 178 log.Infof("Set %v to '%s' as ILM is enabled.", cfg.PathOf("index"), alias) 179 } 180 if mode == ilm.ModeEnabled { 181 indexName = alias 182 } ``` There you are, the annoying flag `ilm.ModeDisabled`. From the code I've read, I must set `setup.ilm.enabled` as `false` to accomplish my goal. So I did it: ```auto # packetbeat.yml for "packetbeat1" output.elasticsearch.index: "packetbeat1-%{[agent.version]}-%{+yyyy.MM.dd}" setup.template.name: "packetbeat1" setup.template.pattern: "packetbeat1-*" setup.ilm.enabled: false ``` And it worked like a champ! # Last thing Is there anyone who can explain to me the reason for all these? Why the configuration of `setup.ilm` affects the behavior of `setup.template`? What's the consideration behind that? Is [the documentation](https://www.elastic.co/guide/en/beats/packetbeat/master/packetbeat-template.html#load-template-auto) misleading? If so, when will it be fixed? Regards, Chushu ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [July 12, 2019, 4:11pm UTC](https://discuss.elastic.co/t/for-anyone-struggling-in-changing-the-index-name-of-your-beats-ive-got-a-solution-finally/190176/2 "2019-07-12T16:11:50Z")
Thanks for your feedback on the documentation. I have a couple of PRs that are already open to fix the documentation: > > Please feel free to add review comments to the open PRs if you think the documentation needs more work. In answer to your question, the ILM settings override `setup.template` because the ILM settings control the rollover alias that's used. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 9, 2019, 4:12pm UTC](https://discuss.elastic.co/t/for-anyone-struggling-in-changing-the-index-name-of-your-beats-ive-got-a-solution-finally/190176/3 "2019-08-09T16:12:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.