Heartbeat 7 configuration issues: monitors & index name

Elastic Stack Beats
1

Hi all,

I upgraded my full stack to 7.0 lately. This morning I noticed no heartbeat docs were coming in my elasticsearch. I started heartbeat with debug logs then I noticed it was not loading any monitors config files even if I have all my monitors in /etc/heartbeat/monitors.d/ as monitor1.yml monitor2.yml monitor3.yml. File permissions are right. I then changed the "path" config from:
path: ${path.config}/monitors.d/*.yml
to
path: /etc/heartbeat/monitors.d/*.yml
Now the monitors are detected and works fine. Weird?

Next even if I had configured my own template settings it created a template with the default options provided like if brand new heartbeat.yml config file was provided. I mean even if I named the template heartbeat-local it named it heartbeat-7.0.0. I also set my elasticsearch output to set the index name to heartbeat-%{+yyyy.MM} and it created the index as:
heartbeat-7.0.0-2019.04.29-000001
Now I agree I should include the version name in my index so I made simple changes on the index pattern and template name but I want those docs to be in monthly created index instead of daily. And I can't find a workaround to have the configuration file read correctly my index name pattern...

My configuration file is correctly loaded by heartbeat since i can actually switch the log levels and change the reload.enabled config successfully.

Here's my heartbeat.yml:

heartbeat.config.monitors:
  #path: ${path.config}/monitors.d/*.yml
  path: /etc/heartbeat/monitors.d/*.yml
  reload.enabled: true
  reload.period: 5s
  
name: local-heartbeat-monitor

setup.kibana:
  host: "<ip>:<port>"
  
output.elasticsearch:
  hosts: ["<ip>:<port>"]
  index: "heartbeat-%{[agent.version]}-%{+yyyy.MM}"
  
setup.template.name: "heartbeat-%{[agent.version]}"
setup.template.pattern: "heartbeat-%{[agent.version]}-*"
setup.template.overwrite: false
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

logging.level: info
logging.to_files: true
logging.files:
  path: "/var/log/heartbeat/logs"
  name: heartbeat.log
  keepfiles: 7
  
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch:

Thanks

2

Hey, beats 7 uses ILM (Index Lifecycle Management) instead of time series indices. This is a much more powerful way of managing index naming. If you'd like to change the naming patterns I'd recommend changing the ILM policy. See https://www.elastic.co/blog/beats-7-0-0-released#ilm for more detail.

3

Thanks @Andrew_Cholakian1 for the ILM details. I'll be happy to work with this new API as it brings nice functionalities. I actually started to work with it since 6.6.

But i'm wondering something... Does this means that the beats indexes will always be using default index naming? We cannot customize it anymore? I only tried to remove the day and keep only year and month so it creates monthly indexes instead of daily. I don't mind the extra 000001 or the lifecycling of my indexes. As I can see the ILM is not managing the index name itself, only the alias it's using and the other ILM details not about the naming itself.

Thanks,

4

Have you seen the ILM config options here? https://www.elastic.co/guide/en/beats/heartbeat/current/ilm.html

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.