I am sending logs to elastic using filebeat but it is not creating the index with the desired name.
filebeat version 7.11.0 (amd64), libbeat 7.11.0 [84c4d4c4034fcb49c1a318ccdc7311d70adee15b built 2021-02-08 22:42:11 +0000 UTC]
This is my config:
logging.metrics.period: 1m
logging.to_files: true
logging.files:
rotateeverybytes: 16777216
keepfiles: 7
permissions: 0600
setup.template.name: "log_prod_services"
setup.template.overwrite: true
setup.template.pattern: "log_prod_services-*"
setup.template.settings:
index.number_of_shards: 3
index.number_of_replicas: 1
filebeat.inputs:
- type: log
enabled: true
json.keys_under_root: true
json.overwrite_keys: true
fields_under_root: true
fields: {
app : 01
}
paths:
- "/var/log/01/operations.log"
- "/var/log/01/operations_debug.log"
- type: log
enabled: true
json.keys_under_root: true
json.overwrite_keys: true
fields_under_root: true
fields: {
app: 02
}
paths:
- "/var/log/02/operations.log"
- "/var/log/02/operations_debug.log"
output.elasticsearch:
hosts: ["10.x.x.x:9200"]
indices:
- index: "log_prod_services-01-%{+yyyy.MM.dd}"
when.contains:
app: "01"
- index: "log_prod_services-02-%{+yyyy.MM.dd}"
when.contains:
app: "02"
In the logs i see this:
2022-08-01T20:56:37.642Z INFO [index-management] idxmgmt/std.go:407 Set setup.template.name to '{filebeat-7.11.0 {now/d}-000001}' as ILM is enabled.
2022-08-01T20:56:37.642Z INFO [index-management] idxmgmt/std.go:412 Set setup.template.pattern to 'filebeat-7.11.0-*' as ILM is enabled.
2022-08-01T20:56:37.642Z INFO [index-management] idxmgmt/std.go:446 Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.11.0 {now/d}-000001} as ILM is enabled.
2022-08-01T20:56:37.642Z INFO [index-management] idxmgmt/std.go:450 Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2022-08-01T20:56:38.153Z INFO template/load.go:97 Template filebeat-7.11.0 already exists and will not be overwritten.
2022-08-01T20:56:38.153Z INFO [index-management] idxmgmt/std.go:298 Loaded index template.
any helps??