# Generate automatic index names like "%{\[container.name\]}-%{+yyyy.MM.dd}" with ILM enabled

**URL:** <https://discuss.elastic.co/t/generate-automatic-index-names-like-container-name-yyyy-mm-dd-with-ilm-enabled/244217>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [August 7, 2020, 7:40pm UTC](https://discuss.elastic.co/t/generate-automatic-index-names-like-container-name-yyyy-mm-dd-with-ilm-enabled/244217 "2020-08-07T19:40:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sholokhov17](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholokhov17/32/73507_2.png) [@sholokhov17](https://discuss.elastic.co/u/sholokhov17)\
**Post date:** [August 7, 2020, 7:40pm UTC](https://discuss.elastic.co/t/generate-automatic-index-names-like-container-name-yyyy-mm-dd-with-ilm-enabled/244217/1 "2020-08-07T19:40:13Z")

</div>

Hello, our worked config of filebeat.yml:

```auto
#===== Filebeat Inputs ======
filebeat.inputs:
- type: docker
  combine_partial: true
  containers:
    path: "/var/lib/docker/containers"
    ids :
      - "*"

#===== Filebeat modules =====
filebeat.config.modules:
    path: "${path.config}/modules.d/*.yml"
    reload.enabled: false

#===== Elasticsearch template setting, we do not create any special template for new containers =====
setup.template:
  name: '%{[container.name]}'
  pattern: '%{[container.name]}-*'
  enabled: false

setup.ilm.enabled: false

#===== Elastic Cloud ======
cloud.id : "ID"
cloud.auth: "AUTH"

#===== Outputs, any new container adds automatic =====
output.elasticsearch.index: "%{[container.name]}-%{+yyyy.MM.dd}"

#==== Processors =====
processors:
    - add_fields:
        target: ''
        fields:
          servertype: "some-servertype"
          domain: "some-domain"
    - add_host_metadata : ~
    - add_cloud_metadata : ~
    - add_docker_metadata: ~
    - decode_json_fields:
        fields: ['message']
        target: json
        max_depth: 4

```

When we enable ILM, filebeat can not generate automatic index names "%{[container.name]}-%{+yyyy.MM.dd}" ..  
How fix this with ILM enabled? Thank for any recommendation..

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 9, 2020, 10:52pm UTC](https://discuss.elastic.co/t/generate-automatic-index-names-like-container-name-yyyy-mm-dd-with-ilm-enabled/244217/2 "2020-08-09T22:52:55Z")

</div>

When ILM creates the first index, it does so with a timestamp. The timestamp in the index name will not change as it's the date that the policy was first used, not the date that the index was rolled.

---

<div class="post-metadata">

**Author:** ![sholokhov17](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholokhov17/32/73507_2.png) [@sholokhov17](https://discuss.elastic.co/u/sholokhov17)\
**Post date:** [August 11, 2020, 10:06pm UTC](https://discuss.elastic.co/t/generate-automatic-index-names-like-container-name-yyyy-mm-dd-with-ilm-enabled/244217/3 "2020-08-11T22:06:21Z")

</div>

If index names will be like

```auto
"%{[container.name]}-%{+yyyy.MM.dd}-\\d+" 

```

this does not problem.  
Could you give sample of config please?

---

<div class="post-metadata">

**Author:** ![Ign0r](https://avatars.discourse-cdn.com/v4/letter/i/bc8723/32.png) [@Ign0r](https://discuss.elastic.co/u/Ign0r)\
**Post date:** [August 13, 2020, 10:36am UTC](https://discuss.elastic.co/t/generate-automatic-index-names-like-container-name-yyyy-mm-dd-with-ilm-enabled/244217/4 "2020-08-13T10:36:38Z")

</div>

Если задействовать ILM (_setup.ilm.enabled: true_), то параметры _setup.template.name_ и _setup.template.pattern_ игнорируются.  
На мой взгляд ILM отлично задействовать для **существующих** индексов (ротация, слияние, замозозка, удаление...). Новый индекс приходится создавать через API создания индексов, естественно с учётом [подстановок](https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 16, 2020, 9:26pm UTC](https://discuss.elastic.co/t/generate-automatic-index-names-like-container-name-yyyy-mm-dd-with-ilm-enabled/244217/5 "2020-08-16T21:26:34Z")

</div>

I don't understand your question sorry.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2020, 11:27pm UTC](https://discuss.elastic.co/t/generate-automatic-index-names-like-container-name-yyyy-mm-dd-with-ilm-enabled/244217/6 "2020-09-13T23:27:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.