Lifecycle policy

[thekm1 (Mathew Thekkekara)]

Hi @Min_Mah
You got several options.

modify

That what you have now is a Index life cycle management which gets configured and created with all what you need by metricbeat. It is possible to modify the created Lifecycle in Kibana. manage created lifecycle

create

The full setup of ILM including lifecycle policies which has been done by metricbeat, can olso be done manually. That is under elasticsearch find create ilm

just define your own policy

You can also let metricbeat setup everything the index lifecycle management, but define your own policy under a file: json file for policy

Let me know if this helped you =)

[Min_Mah]

can i ask something more??

[thekm1 (Mathew Thekkekara)]

Yeah sure =)

[Min_Mah]

Thanks,
i just change metricbeat index like this

and now i have to setup dashboards to kibana
so i type

metricbeat setup

but dashboards follow default index

automatically make new index but it is default index name not mine.
so i think i have to change more in metricbeat.yml
so i tried this

but.. it doesn't work for me

which point i have to change??

[thekm1 (Mathew Thekkekara)]

Please try to paste config parts as string and not as image. It is easier for readers to copy parts out of it and find it via browser search =)

If you go on a dashboard, are they pointing to the indexpattern which you have set with setup.dashboards.index ?
Did you create the "systeminfo-*" index pattern in Kibana ? I think you have to set the id same as the indexpattern name.

Thank you for answering both questions.

[Min_Mah]

Thanks for reply.

in my metricbeat.yml only i was edit

#============================== Kibana =====================================
setup.kibana:

host: "192.168.0.88:5601"
setup.dashboards.index: "systeminfo-*"

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
hosts: ["192.168.0.88:9200"]

setup.ilm.enabled: auto
setup.ilm.rollover_alias: "systeminfo"
setup.ilm.pattern: "000001"
setup.ilm.policy_name: "SystemInfo"

yes i was create systeminfo-* in kibana index pattern

[thekm1 (Mathew Thekkekara)]

I think the dashboard is not working?
Can you send me a printscrren of the error shown on dashbaord ?

[Min_Mah]

Okey!!
Info -1. i have only 1 index

Info -2. when i was type metricbeat setup - then kibana index automatically make (metricbeat-)

Info -3.after setup dashboard follows index - metricbeat- not systeminfo-*

this is dashboard screen

[Min_Mah]

they want to connect index-pattern -> metricbeat-*

[thekm1 (Mathew Thekkekara)]

Ok you got actually 2 errors.

Your visualisations are also pointing to the old index. did you try deleting all visualisations and dashboards from metricbeat and runnning the metricbeat setup --dashboards ? because the setting setup.dashboards.indexshould be enough to point to the correct index-pattern

Then check if the index is pointed correctly. You would have need to create a new index-pattern in kibana which is pointing to systembeat-* with systembeat-* as id. You can provide a custom id during the index-pattern creation.

The other error which you have seems to be a permission error. If you still have that error then try this discuss matter

Hope this helps

[Min_Mah]

I was delete all visualization and dashboards
then metricbeat setup --dashboards but it doesnt' work..
Thanks for helps

[thekm1 (Mathew Thekkekara)]

can you provide the .yml file?
(only not commented lines)

[Min_Mah]

only not commented thing is just this

#========================== Modules configuration ============================
metricbeat.config.modules:
path: ${path.config}/modules.d/*.yml

reload.enabled: false

#==================== Elasticsearch template setting ==========================
setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression

#================================ Processors =====================================

processors:

• add_host_metadata: ~
• add_cloud_metadata: ~

[thekm1 (Mathew Thekkekara)]

hmmmm, where is the setting setup.dashboards.index ?
I tried it with filebeat with the following yml file and it works for me:

#=========================== Filebeat inputs =============================
filebeat.inputs:
type: log
enabled: true
paths:
/var/log/*.log

#============================= Filebeat modules ===============================

filebeat.config.modules:
path: ${path.config}/modules.d/.yml
reload.enabled: false
#============================== Kibana =====================================
setup.kibana.host: "localhost:5601"
setup.dashboards.index: "testbeat-"
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
hosts: ["localhost:9200"]

#================================ Processors =====================================
processors:
add_host_metadata: ~
add_cloud_metadata: ~

[Min_Mah]

setup.dashboards.index is here in metricbeat.yml

#============================== Kibana =====================================
setup.kibana:
host: "192.168.0.88:5601"

setup.dashboards.index: "systeminfo-*"

[thekm1 (Mathew Thekkekara)]

Try running from the following command from metricbeat server.

sudo metricbeat setup --dashboards -E 'setup.dashboards.index="systeminfo-*"'

[Min_Mah]

wow... it works!!!!
you are so great!!
visualize follow index id : systeminfo-*

just 1 error.
kibana index is also make

as you can see that metricbeat-* index pattern is made by setup command but that index pattern can't follow anything..

[thekm1 (Mathew Thekkekara)]

Nice =)

Dashboards working as well ?

[Min_Mah]

yesss i have to try more.
when i'm just using only system metricbeat
it working good!!!!