Getting -000001 at the end of daily index name

Elastic Stack Beats
1

Hi all,

I am using Filebeat -> Elasticsearch -> Kibana setup (version 7.1.1) for viewing our application level logs. One index is created per day and logs shipped by filebeat from our file logs are stored. The expected index name is "filebeat-7.1.1-yyyy.MM.dd".

But I am getting a single index for all days and the pattern is like "filebeat-7.1.1-yyyy.MM.dd-000001".

I want to know the reason for '-000001' getting appended at the end of the index name. It was working as expected in version 6.3.x.

2

i could be wrong, but probably some of elastics new roll over indexing and lifecycle rules are coming into effect.

https://www.elastic.co/guide/en/elasticsearch/reference/master/set-up-lifecycle-policy.html

when a index meets certain rule standards (a certain gb in size, number of documents, etc) it rolls over to another file