Thanks @shaunak I was going to answer my own question. I found the answer some hours ago in the link: https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html
The problem is about the ILM and to figure it out is necessary disable ILM in the filebeat setup.
Following my ConfigMap:
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: monitoring
labels:
k8s-app: filebeat
data:
filebeat.yml: |-
setup.ilm.enabled: false
filebeat.autodiscover:
providers:
- type: kubernetes
node: ${NODE_NAME}
hints.enabled: true
hints.default_config:
type: container
paths:
- /var/log/containers/*${data.kubernetes.container.id}.log
processors:
- add_cloud_metadata:
- add_host_metadata:
cloud.id: ${ELASTIC_CLOUD_ID}
cloud.auth: ${ELASTIC_CLOUD_AUTH}
setup.template.name: "filebeat-stg"
setup.template.overwrite: true
setup.template.enabled: true
setup.template.pattern: "filebeat-stg-*"
output.elasticsearch:
hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
index: "filebeat-stg-%{[agent.version]}-%{+yyyy.MM.dd}"