What is the output of
metricbeat version
If you are still getting 7.4 is there another host with metricbeat running?
If you are using 7.14 and want ILM etc etc. you should run
metricbeat setup -e
first while metricbeat is pointing to elasticsearch this will set up all the assets ILM etc...
Then change metricbeat.yml to point to logstash and use the pipeline below.
(do the same for filebeat)
You can look at this thread where I explain this
Your logstash should be of the form (you can add your extra filtering in)
################################################
# beats->logstash->es default config.
################################################
input {
beats {
port => 5044
}
}
output {
if [@metadata][pipeline] {
elasticsearch {
hosts => "http://localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}"
pipeline => "%{[@metadata][pipeline]}"
user => "elastic"
password => "secret"
}
} else {
elasticsearch {
hosts => "http://localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}"
user => "elastic"
password => "secret"
}
}
}