I'm using ECK helm chart and created a Filebeat with Beat CRD:
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
name: quickstart
namespace: default
spec:
type: filebeat
version: 8.17.3
elasticsearchRef:
name: quickstart
config:
filebeat.inputs:
- type: container
paths:
- /var/log/containers/*.log
output.elasticsearch:
ilm:
enabled: true
policy_name: "filebeat_policy"
......
I created a filebeat_policy.json
policy:
{
"policy":{
"phases":{
"hot":{
"actions":{
"rollover":{
"max_age": "1d",
"max_docs": 10000,
"max_size": "10gb"
}
}
},
"delete":{
"min_age":"30d",
"actions":{
"delete":{
}
}
}
}
}
}
But after I create policy this way:
curl -X PUT -k -u elastic:$ELASTIC_PASSWORD "https://localhost:9200/_ilm/policy/filebeat_policy" -H 'Content-Type: application/json' -d @./values/elastic/filebeat-policy.json
I can't find the filebeat_policy
in the current Elasticsearch indices:
curl -X GET -k -u elastic:$ELASTIC_PASSWORD "https://localhost:9200/_data_stream/filebeat-*?pretty"
If I do this way, it works:
curl -X PUT -k -u elastic:$ELASTIC_PASSWORD "https://localhost:9200/_component_template/filebeat-settings" -H 'Content-Type: application/json' -d '
{
"template": {
"settings": {
"index.lifecycle.name": "filebeat_policy"
}
}
}'
curl -X PUT -k -u elastic:$ELASTIC_PASSWORD "https://localhost:9200/_index_template/filebeat-8.15.3" -H 'Content-Type: application/json' -d '
{
"index_patterns": ["filebeat-*"],
"data_stream": {},
"composed_of": ["filebeat-settings"]
}'
So my question is, if use Beat CRD, doesn't it work in config
section below?
output.elasticsearch:
ilm:
enabled: true
policy_name: "filebeat_policy"