Multiple ilm and template for multiple index in filebeat directly to elasticsearch

Hi ,
I am gathering log from multiple containers and I want to send them to multiple index with multiple ilm and template , here is my config:

      filebeat.autodiscover:
        providers:
          - type: kubernetes
            hints.enabled: true
            templates:
              - condition:
                - equals:
                    kubernetes.container.name: "nginx"
                config:
                  - module: nginx
                    access:
                      enabled: true
                      input:
                        type: container
                        fields:
                          type: hypernova-nginx
                        paths:
                          - /var/log/containers/*-${data.kubernetes.container.id}.log     
              - condition:
                  equals:
                    kubernetes.container.name: "ingress-nginx-controller"
                config:
                  - module: nginx
                    ingress_controller:
                      enabled: true
                      input:
                        type: container
                        fields:
                          type: ingress 
                        paths:
                          - /var/log/containers/*-${data.kubernetes.container.id}.log
      processors:
        - add_kubernetes_metadata:
      output.elasticsearch:
        indices:
          - index: "ingress-template-%{+yyyy.MM.dd}-000001"
            when.equals:
              fields.type: "ingress"
            setup.template:
              name: "ingress-template"
              pattern: "ingress-*"
              type: index
            setup.ilm:
              enabled: true
              rollover_alias: "ingress-template"
              pattern: "{now/d}-000001"
              policy_name: "ingress-custom"
          - index: "hypernova-nginx-template-%{+yyyy.MM.dd}-000001"
            when.equals:
              fields.type: "hypernova-nginx"
            setup.template:
              name: "hypernova-nginx-template"
              pattern: "hypernova-nginx-*"
              type: index
            setup.ilm:
              enabled: true
              rollover_alias: "hypernova-nginx-template"
              pattern: "{now/d}-000001"
              policy_name: "hypernova-nginx-custom"

        hosts: ["X", "X"]
        bulk_max_size: 100

logs go to their own index but ilm and template look like not working and rollover doesnot work.
any ideas?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.