Query on ELK stack version 8.12: post installation

Elastic Stack Elasticsearch
1

Hello,

I have installed ELK stack version 8.12 on one of the test instance. The purpose was to assign the existing ILM policy set for ver 7.17, as I could see new indices are being built with filebeat version 8.x on a production. Reference previous discussion link below.

Currently after the installation of ELK ver 8.12. I could see as below for the GET request in which I could see the file name starts with .ds-filebeat-8.12.x and it is seen as ".ds-filebeat-8.12.0-2024.02.01-000001"

In this case how to run the GET request e.g. GET filebeat-7.17.15-2024.01.11/_ilm/explain because the same is not working when tried for version 8.12

# curl -X GET "localhost:9200/_cat/indices?v"
health status index                                 uuid                   pri rep docs.count docs.deleted store.size pri.store.size dataset.size
yellow open   .ds-filebeat-8.12.0-2024.02.01-000001 BL9XeL3HTlqCfsoGnbRtIw   1   1       8963            0     24.4mb         24.4mb       24.4mb

# curl -X GET "http://localhost:9200/"
{
  "name" : "ip-x-x-x-x",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "vWptk-xqQJuNhIdnG9yfkw",
  "version" : {
    "number" : "8.12.0",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "1665f706fd9354802c02146c1e6b5c0fbcddfbc9",
    "build_date" : "2024-01-11T10:05:27.953830042Z",
    "build_snapshot" : false,
    "lucene_version" : "9.9.1",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

GET _cat/indices?v

.count docs.deleted store.size pri.store.size dataset.size
yellow open   .ds-filebeat-8.12.0-2024.02.01-000001 BL9XeL3HTlqCfsoGnbRtIw   1   1       8975            0       24mb           24mb         24mb
yellow open   .ds-filebeat-8.12.0-2024.02.01-000002 Wd2KFb-FTgSoACMhwZWGxQ   1   1         22            0    299.6kb        299.6kb      299.6kb

Thanks,

2

Was able to find the answer on the syntax for the same.

GET <filebeat-8.12.0>

{
  ".ds-filebeat-8.12.0-2024.02.02-000006": {
    "aliases": {},
    "mappings": {
      "_meta": {
        "beat": "filebeat",
        "version": "8.12.0"
      },
      "_data_stream_timestamp": {
        "enabled": true
      },

GET /.ds-filebeat-8.12.0-2024.02.02-000006

{
  ".ds-filebeat-8.12.0-2024.02.02-000006": {
    "aliases": {},
    "mappings": {
      "_meta": {
        "beat": "filebeat",
        "version": "8.12.0"
      },
      "_data_stream_timestamp": {
        "enabled": true
      },
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.