Hi,
I am trying to implement index lifecycle management from Kibana UI. Note that I have already implemented X-Pack Security for Elasticsearch, Logstash and Kibana, but not for beats. Now I am facing weird problem. Below is my beats template in the ES cluster.
{
"filebeat" : {
"order" : 0,
"index_patterns" : [
"filebeat-*"
],
"settings" : {
"index" : {
"lifecycle" : {
"name" : "Test",
"rollover_alias" : "filebeat01"
},
"refresh_interval" : "60s",
"number_of_shards" : "3",
"number_of_replicas" : "1"
}
},
"mappings" : { },
"aliases" : { }
}
}
Currently delete phase is working properly from the ILM but whenever I active the hot phase rollover it doesn't work. I have manually created one index with is_write_index set true. Then started sending data from filebeat to logstash.
I had to assign the rollover alias filebeat01 manually to each indices otherwise they show error that rollover alias filebeat01 does not point to index filebeat-2019-50`. But if I mention the alias in the template it shows another error that alias is duplicate.
Please help to solve this issue. Thanks in advance.