I have ES 8.12.2. I have looked at subsequent release notes and cannot see that this has been rectified. I have created my own index template with composable components. Lets say the index is logs-jde.access-*.
I am using Elastic agent enrolled through fleet.
As this is a custom log format, I add in a custom logs integration to a profile - dataset: jde.access, namespace: preprod. However, when I save it, I get the error message in the subject line. If I delete my index, then I can save the integration, and it creates the index for me.
I then create a new (different) profile (Because the target machine of this profile will have different integrations, and I want to send it to a different namespace) and try to include a custom log integration for logs-jde.access-prod (namespace: prod). However I get the same issue.
I cannot see how to use the force flag, and probably don't want to do this as it would mean overwriting the current (wanted) template.
Google turns up this link: but it appears that the page has gone: https://discuss.elastic.co/t/adding-managed-index-template-to-custom-log-integration-elastic-agent/339878
I came across this Github issue from awhile ago: [Fleet] Input only packages: Create index templates and pipelines at package policy creation time · Issue #145529 · elastic/kibana · GitHub
I cannot see how to make an input only template, ie without it creating the indexes etc.
So, the outcome I want:
- Have two datastreams: logs-jde.access-nonprod and logs.jde.access-prod defined in different profiles.
- Use custom log integrations as this is the only way I can do it from what I see for integrations into Elastic agent in multiple different policies.
- Use fleet managed Elastic agents, as this makes maintenance easier.
How can this be done, or do I need to revert back to filebeat agents to achieve this?