Setup.template.name not work

[pi314 (Emanuel Gonzalez)]

I am sending logs to elastic using filebeat but it is not creating the index with the desired name.

filebeat version 7.11.0 (amd64), libbeat 7.11.0 [84c4d4c4034fcb49c1a318ccdc7311d70adee15b built 2021-02-08 22:42:11 +0000 UTC]

This is my config:

logging.metrics.period: 1m
logging.to_files: true
logging.files:
  rotateeverybytes: 16777216
  keepfiles: 7
  permissions: 0600

setup.template.name: "log_prod_services"
setup.template.overwrite: true
setup.template.pattern: "log_prod_services-*"
setup.template.settings:
  index.number_of_shards: 3
  index.number_of_replicas: 1

filebeat.inputs:
- type: log
  enabled: true
  json.keys_under_root: true
  json.overwrite_keys: true
  fields_under_root: true
  fields: {
    app : 01
  }
  paths: 
   - "/var/log/01/operations.log" 
   - "/var/log/01/operations_debug.log" 
 
 
- type: log 
  enabled: true 
  json.keys_under_root: true 
  json.overwrite_keys: true 
  fields_under_root: true 
  fields: { 
    app: 02
  } 
  paths: 
   - "/var/log/02/operations.log" 
   - "/var/log/02/operations_debug.log" 
 
output.elasticsearch: 
 hosts: ["10.x.x.x:9200"]
 indices: 
   - index: "log_prod_services-01-%{+yyyy.MM.dd}" 
     when.contains: 
       app: "01" 
   - index: "log_prod_services-02-%{+yyyy.MM.dd}"    
     when.contains: 
       app: "02"

In the logs i see this:

2022-08-01T20:56:37.642Z        INFO    [index-management]      idxmgmt/std.go:407      Set setup.template.name to '{filebeat-7.11.0 {now/d}-000001}' as ILM is enabled.
2022-08-01T20:56:37.642Z        INFO    [index-management]      idxmgmt/std.go:412      Set setup.template.pattern to 'filebeat-7.11.0-*' as ILM is enabled.
2022-08-01T20:56:37.642Z        INFO    [index-management]      idxmgmt/std.go:446      Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.11.0 {now/d}-000001} as ILM is enabled.
2022-08-01T20:56:37.642Z        INFO    [index-management]      idxmgmt/std.go:450      Set settings.index.lifecycle.name in template to {filebeat {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2022-08-01T20:56:38.153Z        INFO    template/load.go:97     Template filebeat-7.11.0 already exists and will not be overwritten.
2022-08-01T20:56:38.153Z        INFO    [index-management]      idxmgmt/std.go:298      Loaded index template.

any helps??

[Andrea_Spacca]

Hello @pi314

The following does not seems to be right settings for ILM:

@pi314

setup.template.name: "log_prod_services"
setup.template.pattern: "log_prod_services-*"

setup.template. rollover_alias: "log_prod_services-"
setup.template.pattern: "{now/d}-01"

Anyway if I got it right you would like to define two different writing aliases: log_prod_services-01 and log_prod_services-02 where -0X is -{app}, is this correct?

This cannot be achieved with ILM on Filebeat side, as the -0X will be the incremented index of a rollover target (see: Rollover index API | Elasticsearch Guide [7.11] | Elastic)