Index creating problem

Elastic Stack Beats
1

Hello,
I create index with the filebeat (v 7.9.2) configuration below:

setup.ilm.enabled: auto
setup.ilm.rollover_alias: "filebeat-%{[agent.version]}"
setup.ilm.pattern: "{now/w{yyyy.ww}}-000001"

Firstly index creating properly like: filebeat-7.9.2-2020.10.24-000001 with an alias filebeat-7.9.2.

But if I delete the index, the index is creating just like: filebeat-7.9.2 with no alias.
(I did not restart filebeat)

Why not the index created properly like at the first time?

Regards.

2

Doesn't match your setup pattern of yyyy.xx

Watch the logs at first filebeat startup, does it load a template and create the first index? Always check the logs of the first (in the stack for this index) filebeat startup. I think the index with yyyy.mm.dd is the default with very little filebeat customization. This acts like there is no alias. Does the first index may not be ILM'ed, even with the name. Then the second index is created because the filebeat target is "filebeat-{version}", but no alias exists, so it creates that index.

3

Sorry @rugenl , the first index is filebeat-7.9.2-2020.43-000001 actually. I writed wrongly, my fault.
When I delete a index, do I have to restart the filebear for proper index creation?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.