Query on ELK stack version 8.12: post installation

[Ravi_Pattar]

Hello,

I have installed ELK stack version 8.12 on one of the test instance. The purpose was to assign the existing ILM policy set for ver 7.17, as I could see new indices are being built with filebeat version 8.x on a production. Reference previous discussion link below.

About the ILM policy implented and on the post observations

Hello, Thank you for the response. Will test and update here on the same thread. Thanks,

Currently after the installation of ELK ver 8.12. I could see as below for the GET request in which I could see the file name starts with .ds-filebeat-8.12.x and it is seen as ".ds-filebeat-8.12.0-2024.02.01-000001"

In this case how to run the GET request e.g. GET filebeat-7.17.15-2024.01.11/_ilm/explain because the same is not working when tried for version 8.12

# curl -X GET "localhost:9200/_cat/indices?v"
health status index                                 uuid                   pri rep docs.count docs.deleted store.size pri.store.size dataset.size
yellow open   .ds-filebeat-8.12.0-2024.02.01-000001 BL9XeL3HTlqCfsoGnbRtIw   1   1       8963            0     24.4mb         24.4mb       24.4mb

# curl -X GET "http://localhost:9200/"
{
  "name" : "ip-x-x-x-x",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "vWptk-xqQJuNhIdnG9yfkw",
  "version" : {
    "number" : "8.12.0",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "1665f706fd9354802c02146c1e6b5c0fbcddfbc9",
    "build_date" : "2024-01-11T10:05:27.953830042Z",
    "build_snapshot" : false,
    "lucene_version" : "9.9.1",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

GET _cat/indices?v

.count docs.deleted store.size pri.store.size dataset.size
yellow open   .ds-filebeat-8.12.0-2024.02.01-000001 BL9XeL3HTlqCfsoGnbRtIw   1   1       8975            0       24mb           24mb         24mb
yellow open   .ds-filebeat-8.12.0-2024.02.01-000002 Wd2KFb-FTgSoACMhwZWGxQ   1   1         22            0    299.6kb        299.6kb      299.6kb

Thanks,

[Ravi_Pattar]

@Ravi_Pattar

In this case how to run the GET request e.g. GET filebeat-7.17.15-2024.01.11/_ilm/explain because the same is not working when tried for version 8.12

Was able to find the answer on the syntax for the same.

GET <filebeat-8.12.0>

{
  ".ds-filebeat-8.12.0-2024.02.02-000006": {
    "aliases": {},
    "mappings": {
      "_meta": {
        "beat": "filebeat",
        "version": "8.12.0"
      },
      "_data_stream_timestamp": {
        "enabled": true
      },

GET /.ds-filebeat-8.12.0-2024.02.02-000006

{
  ".ds-filebeat-8.12.0-2024.02.02-000006": {
    "aliases": {},
    "mappings": {
      "_meta": {
        "beat": "filebeat",
        "version": "8.12.0"
      },
      "_data_stream_timestamp": {
        "enabled": true
      },