# No way to specify filebeat 8.0.0 data stream and index template pattern

**URL:** <https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 11, 2022, 1:38pm UTC](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979 "2022-02-11T13:38:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rouke-broersma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rouke-broersma/32/101722_2.png) [@rouke-broersma](https://discuss.elastic.co/u/rouke-broersma)\
**Post date:** [February 11, 2022, 1:38pm UTC](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979/1 "2022-02-11T13:38:38Z")

</div>

In filebeat 7.x we were able to specify custom index template and rollover\_alias for the indexes used by filebeat. We use this to split which indices different filebeats send their logs to because some filebeats collect general logfiles from different applications and some filebeats collect logs from specific products like for example nginx. We don't want this generic logging to be bundled with nginx logging so we don't use the same indices. After testing the upgrade to 8.0.0 we noticed that this setting was no longer honored and that there does not seem to be any alternative in 8.0.0 data streams. See: [Configure index lifecycle management | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/ilm.html#setup-ilm-rollover_alias-option)

We cannot use [Change the index name | Filebeat Reference [8.0] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/change-index-name.html) because we use ILM.

How are we supposed to do this now? Or are we actually just trying to do something we should not be doing?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [February 11, 2022, 2:12pm UTC](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979/2 "2022-02-11T14:12:03Z")

</div>

`rollover_alias` has been removed because it does not make sense in data streams. A data stream is basically an alias with backing indices, and the data stream name is the only alias you will ever need. You can either load the default ILM policy of Beats to manage the backing indices of the data stream. But we encourage you to use the UI in Kibana because it can lead you through the whole process: [Tutorial: Automate rollover with ILM | Elasticsearch Guide [8.0] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html#getting-started-index-lifecycle-management)

If I understood your use case correctly, you can just configure different `setup.template.name` and `setup.template.pattern` for each Filebeat instance you are running.

---

<div class="post-metadata">

**Author:** ![rouke-broersma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rouke-broersma/32/101722_2.png) [@rouke-broersma](https://discuss.elastic.co/u/rouke-broersma)\
**Post date:** [February 11, 2022, 2:43pm UTC](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979/3 "2022-02-11T14:43:10Z")

</div>

Thank, we will try using the template name and pattern as suggested.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 11, 2022, 2:45pm UTC](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979/4 "2022-02-11T14:45:18Z")

</div>

You can also use a custom template and set your ILM policy there.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2022, 4:45pm UTC](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979/5 "2022-03-11T16:45:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
