with space when using setup.ilm.enabled: auto

Hello everyone,

I wonder whether I tripped over a bug or whether I might misunderstand the documentation.
I'm using filebeat 7.3.2 and want to use ilm, but also create indices based on my environments.

config settings:

    setup.ilm.enabled: auto
    setup.ilm.policy_name: "ilm-policy-filebeat-${cluster_name}"
    setup.ilm.rollover_alias: "filebeat-${cluster_name}"
    setup.ilm.pattern: "{+yyyy.MM.dd}-000001"
    setup.ilm.check_exists: false
    setup.ilm.overwrite: true
      hosts: 'https://elasticsearch.local:443'

The above variable ${cluster_name} expands to testing-europe.

In the startup log I can see this:

INFO    [index-management]      idxmgmt/std.go:178      Set output.elasticsearch.index to 'filebeat-testing-europe' as ILM is enabled.
2019-09-30T14:06:27.870Z        INFO    elasticsearch/client.go:743     Attempting to connect to Elasticsearch version 7.3.0
2019-09-30T14:06:27.915Z        INFO    [index-management]      idxmgmt/std.go:252      Auto ILM enable success.
2019-09-30T14:06:28.410Z        INFO    [index-management]      idxmgmt/std.go:265      ILM policy successfully loaded.
2019-09-30T14:06:28.410Z        INFO    [index-management]      idxmgmt/std.go:394      Set to '{filebeat-testing-europe {+yyyy.MM.dd}-000001}' as
ILM is enabled.
2019-09-30T14:06:28.410Z        INFO    [index-management]      idxmgmt/std.go:399      Set setup.template.pattern to 'filebeat-testing-europe-*' as ILM is enabled.
2019-09-30T14:06:28.410Z        INFO    [index-management]      idxmgmt/std.go:433      Set settings.index.lifecycle.rollover_alias in template to {filebeat-testing-eu
rope {+yyyy.MM.dd}-000001} as ILM is enabled.
2019-09-30T14:06:28.411Z        INFO    [index-management]      idxmgmt/std.go:437      Set in template to {ilm-policy-filebeat-testing-e
urope {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2019-09-30T14:06:28.489Z        INFO    template/load.go:108    Try loading template filebeat-testing-europe to Elasticsearch
2019-09-30T14:06:28.804Z        INFO    template/load.go:100    template with name 'filebeat-testing-europe' loaded.
2019-09-30T14:06:28.804Z        INFO    [index-management]      idxmgmt/std.go:289      Loaded index template.
2019-09-30T14:06:28.814Z        INFO    [index-management]      idxmgmt/std.go:298      Write alias exists already

It seems like the is a concatenation of setup.ilm.rollover_alias and setup.ilm.pattern but with a space in between.
This looks wrong, doesn't it?

In kibana I can see an index filebeat-testing-europe and also my ilm policy named ilm-policy-filebeat-testing-europe.
However, there are no indices attached to the policy. Which makes somewhat sense, because filebeat decided to match on filebeat-testing-europe-*, but the index is just named filebeat-testing-europe.
so... according to the docs this should just work, but it doesn't. What am I doing wrong here?

Thanks in advance!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.