Metricbeat Index name not looking quite right

Elastic Stack Beats
1

I am running v7.7.1 of the stack on a Windows 10 box.
It is a pretty basic install, not a lot of customization. I ingest both from filebeat and metricbeat. Filebeat did what I thought it would do, create an Index as filebeat-7.7.1-2021-05-10-000001. Every install I have done using filebeat dos this by default. From other installs, I expect Metricbeat to do something similar, create an index as metricbeat-7.7.1-2021-05-10-000001.
But, it is not in this case, it creates an index as metricbeat-7.7.1
I have dropped the index several times and it always comes back the same way.

So, why would it be doing this?

Thank you !

2

Try deleting the indices run Metricbeat setup again then start. Looks like it's actually writing data to the write alias but at the alias is not there and so it's actually writing data into that index name.

7.7 is a ways back I think that should work. This assumes you have not gone in an alter the index name or any of the other settings just using the defaults.

3

My post may have been a bit confusing, it's metricbeat I'm having the problem with. But your point is taken. I had deleted the index, but it came right back the same. I don't have access to the machine that is running metricbeat so restarting and running setup may be difficult. I will hold on to that card should nothing else work.

I did recreate the index in devtools with the correct name. It seems to be working so far. I'll see if it follows the ILM policy on rollover.

Thanks!

4

ILM will probably not work without the write alias (it might I have not tried every error combination). I think if you clean up and even just have them start / stop metricbeat after you clean up it would help.

Good luck.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.