Separate process setup and write winlogbeat

I probably do not understand correctly what parameters should be in the configuration files when separating the installation process and writing data.

Please help me understand how it works correctly

my setup YML file

setup.ilm.enabled: true
setup.template.enabled: true
  index.number_of_shards: 1
  index.number_of_replicas: 0
setup.dashboards.enabled: true
setup.ilm.check_exists: true
setup.ilm.overwrite: true

  username: "beats_setup"
  password: "pass1"
  protocol: http
  hosts: [""]

i run
.\winlogbeat.exe setup --index-management -c .\setup.yml -v

process create template - winlogbeat-7.6.2
ILM policy - winlogbeat
and empty index - winlogbeat-7.6.2-2020.05.08-000001

it`s fine.

next step run write process
firs i modify ILM policy in Kibana for my setting
and start winlogbeat service

My write config

setup.ilm.enabled: false
setup.template.enabled: false
setup.dashboards.enabled: false
setup.ilm.check_exists: false
setup.ilm.overwrite: false

  username: "beats_write"
  password: "pass2"
  protocol: http
  hosts: [""]

in ES will create index with name
without last number

it`s not correct.

may be i not understand correctly doc.
i think on setup step we upload template and ILM on server
edit it if need

on write step we put event to server, ans ES use exist template and ILM for index
in my write config i disable rewrite server policy beats policy and template.

Or i not right?

i found where error
in write yml

setup.ilm.enabled: false

i fix it to

setup.ilm.enabled: true

and all work fine

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.