For kibana setup from audit beat:
(In the both verision I am discribing below, I am using the parameter setup.dashboard.index from "./auditbeat setup" command to set the index-pattern title )
in Version 6.7, I was able to set the index-pattern title by setting the parameter "setup.dashboards.index" and the value of that attribute was used as the title of the index-pattern in Kibana.
But this is not working anymore in version 7.1.1 Elastic Stack. You can set the auditbeat setup parameter "setup.dashboards.index" to whatever you want, but it takes the default value "auditbeat-*" as index pattern.
Is this maybe a bug? or am I just missing something.
hi @thekm1, starting with 7.0, auditbeat will use index lifecycle management by default when it connects to a cluster that supports lifecycle management and will load the default policy automatically which will apply to any indices created by auditbeat (https://www.elastic.co/guide/en/beats/auditbeat/current/ilm.html).
If you set setup.ilm.enabled to false and retry your current setup do you see any results? If not, can you provide us with the content of the auditbeat.yml file?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.