ILM config for beats


I was wondering if the index logic for beats was changed due to ILM settings.

In the logs of filebeat, I see Set output.elasticsearch.index to 'filebeat-7.3.1' as ILM is enabled.. This is different from the base config where the beats to to filebeat-7.3.1-YYYY-MM-DD.

The problem is that the template patterns won't work anymore (because they are configured by default to listen to filebeat-7.3.1-*).

I want to fix the policies on my cluster, but I was wondering if the date suffix is still desired, now that we have ILM to rollover indices.

What is the view of Elastic on this?

My aliases were broken on the server, so that problem is fixed, but the question still remains if it is still useful to use date suffixes on indices when using ILM.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.