Hi @ashishtiwari1993, I looked through various documentations and blogs but mostly came across the idea that we can configure only 1 rollback alias for a particular ilm policy. Although when I'm trying to configure one rollback alias, I'm getting the below error:
Connection marked as failed because the onConnect callback failed: error creating index management handler: error creating ES handler: error unpacking lifecycle config: can not convert 'string' into 'bool' accessing 'setup.ilm.enabled'
The ILM configuration is as below
# ================================= ILM Configure ================================
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "filebeat-log-test"
setup.ilm.pattern: "{now/d}-0001"
setup.ilm.policy_name: "filebeat-log-test-ilm-policy"
setup.ilm.check_exists: true
setup.ilm.overwrite: false
I am curious about setup.ilm.enabled:auto but as per doc valid values should be true or false. Could you please confirm?
@ashishtiwari1993, I tried it with both. but still the same response. Could this be happening due to version differences? I've configured filebeat with version 8.x while elastic has 7.17 version.
Quite possible because in 7.17, value values were true, false and auto but in 8.15, It is just true and false.
While upgrading, I will recommend to check breaking changes.
I'm trying to create multiple indexes for n number of log file paths provided. I was initially trying to create different ILM Policy for each of those but then moved to creating a single ILM Policy and single template settings for all. However, filebeat fails at ILM Policy creation. I've utilized the fields.log-name parameter to get different indexes for each of the log files.
Another approach could be, You define multiple inputs in filebeat configuration file for different set of logs file (or individual)