Massive index creation after conditional indexing

[Samuel_Ruiz_Garcia (Samuel Ruiz)]

We have a server, where we had previously configured a filebeat for a simple monitoring of log files. A month ago we were asked to ingest the record of a containered docker application, but this had to be recorded in a separate index.
We had two options, set conditional indexing in the same filebeat implementation we had at the time, or set a filebeat container docker for this purpose. As we had implemented filebeat previously, we set conditional indexing in the same filebeat implementation we had at the time.

From day one, the filebeat is creating an index per day, and at this time, with the previous record of the container (which was also recorded, creating indexes with the registration date of those days. I mean, this was configured 2024.04.19 and elastic created indexes from 2024.02.20, day by day), we have 103 indexes of this monitoring. Besides the daily indexes from the previous monitoring.

[leandrojmp (Leandro Pereira)]

Hello and welcome,

Can you please share your filebeat configuration and some evidence of your issue? it is not clear what is the issue here.

[Samuel_Ruiz_Garcia (Samuel Ruiz)]

@Samuel_Ruiz_Garcia

We have a server, where we had previously configured a filebeat for a simple monitoring of log files. A month ago we were asked to ingest the record of a containered docker application, but this had to be recorded in a separate index.
We had two options, set conditional indexing in the same filebeat implementation we had at the time, or set a filebeat container docker for this purpose. As we had implemented filebeat previously, we set conditional indexing in the same filebeat implementation we had at the time.

From day one, the filebeat is creating an index per day, and at this time, with the previous record of the container (which was also recorded, creating indexes with the registration date of those days. I mean, this was configured 2024.04.19 and elastic created indexes from 2024.02.20, day by day), we have 103 indexes of this monitoring. Besides the daily indexes from the previous monitoring.

Hi, since i am a new user i cant upload media in a reply. So i have created a new post uploading evidences there. Hope that helps. Thanks

Massive index creation after conditional indexing

We have a server, where we had previously configured a filebeat for a simple monitoring of log files. A month ago we were asked to ingest the record of a containered docker application, but this had to be recorded in a separate index. We had two options, set conditional indexing in the same filebeat implementation we had at the time, or set a filebeat container docker for this purpose. As we had implemented filebeat previously, we set conditional indexing in the same filebeat implementation we …