Need help understanding index templates

Elastic Stack Elasticsearch
1

I have metricbeat installed/set up. I wanted my own index name so i put the below in metricbeat.yml file


index: "adm_jkafka"

this gave me an error stating that when i want to use my own index, i need to mention the


setup.template.name and setup.template.pattern

i put the below


setup.template.name: "adm_jkafka"
setup.template.pattern: "*jkafka*"

I dont have a template with this name.

when i start metricbeat it is throwing the below error


ERROR   [publisher_pipeline_output]     pipeline/output.go:154  Failed to connect to backoff(elasticsearch(http://****:9200)): Connection marked as failed because the onConnect callback failed: resource 'metricbeat-7.10.0' exists, but it is not an alias

this looks like is trying to use the default template becuase i havent defined one.

How do i define a template called adm_jkafka with the same fields as metricbeat since this is going to be metricbeat.

OR

should i be creating an alias called adm_jkafka pointing to metricbeat-7.10.0 if i do create an alias what should be the setup.template.pattern field set to?

2

Update:

did a export of metric beat template and made the below change to the JSON on the top


 "index_patterns": [
    "mftadm_jkafka*"
  ],

then used below

curl -XPUT -u mftadm:mftadm -H 'Content-Type: application/json' http://*****:9200/_template/mftadm_jkafka -d@metricbeat.template.json

this i see created an index template

then when i start metricbeat i still see the below error


2020-12-09T10:33:18.924-0500    ERROR   [publisher_pipeline_output]     pipeline/output.go:154  Failed to connect to backoff(elasticsearch(http://*****:9200)): Connection marked as failed because the onConnect callback failed: resource 'metricbeat-7.10.0' exists, but it is not an alias
3

Update:

i had to add this to the metricbeat.yml for it use my custom index name

setup.ilm.enabled: false

4

It's not recommended to use a single index to hold time based data. You cannot easily remove old data from such an index.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.