Generate automatic index names like "%{[]}-%{+yyyy.MM.dd}" with ILM enabled

Hello, our worked config of filebeat.yml:

#===== Filebeat Inputs ======
- type: docker
  combine_partial: true
    path: "/var/lib/docker/containers"
    ids :
      - "*"

#===== Filebeat modules =====
    path: "${path.config}/modules.d/*.yml"
    reload.enabled: false

#===== Elasticsearch template setting, we do not create any special template for new containers =====
  name: '%{[]}'
  pattern: '%{[]}-*'
  enabled: false

setup.ilm.enabled: false

#===== Elastic Cloud ======  : "ID"
cloud.auth: "AUTH"

#===== Outputs, any new container adds automatic =====
output.elasticsearch.index: "%{[]}-%{+yyyy.MM.dd}"

#==== Processors =====
    - add_fields:
        target: ''
          servertype: "some-servertype"
          domain: "some-domain"
    - add_host_metadata  : ~
    - add_cloud_metadata : ~
    - add_docker_metadata: ~
    - decode_json_fields:
        fields: ['message']
        target: json
        max_depth: 4

When we enable ILM, filebeat can not generate automatic index names "%{[]}-%{+yyyy.MM.dd}" ..
How fix this with ILM enabled? Thank for any recommendation..

When ILM creates the first index, it does so with a timestamp. The timestamp in the index name will not change as it's the date that the policy was first used, not the date that the index was rolled.

1 Like

If index names will be like


this does not problem.
Could you give sample of config please?

Если задействовать ILM (setup.ilm.enabled: true), то параметры и setup.template.pattern игнорируются.
На мой взгляд ILM отлично задействовать для существующих индексов (ротация, слияние, замозозка, удаление...). Новый индекс приходится создавать через API создания индексов, естественно с учётом подстановок

1 Like

I don't understand your question sorry.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.