Hello everyone,
I wonder whether I tripped over a bug or whether I might misunderstand the documentation.
I'm using filebeat 7.3.2 and want to use ilm, but also create indices based on my environments.
config settings:
setup.ilm.enabled: auto
setup.ilm.policy_name: "ilm-policy-filebeat-${cluster_name}"
setup.ilm.rollover_alias: "filebeat-${cluster_name}"
setup.ilm.pattern: "{+yyyy.MM.dd}-000001"
setup.ilm.check_exists: false
setup.ilm.overwrite: true
output.elasticsearch:
hosts: 'https://elasticsearch.local:443'
The above variable ${cluster_name} expands to testing-europe.
In the startup log I can see this:
INFO [index-management] idxmgmt/std.go:178 Set output.elasticsearch.index to 'filebeat-testing-europe' as ILM is enabled.
2019-09-30T14:06:27.870Z INFO elasticsearch/client.go:743 Attempting to connect to Elasticsearch version 7.3.0
2019-09-30T14:06:27.915Z INFO [index-management] idxmgmt/std.go:252 Auto ILM enable success.
2019-09-30T14:06:28.410Z INFO [index-management] idxmgmt/std.go:265 ILM policy successfully loaded.
2019-09-30T14:06:28.410Z INFO [index-management] idxmgmt/std.go:394 Set setup.template.name to '{filebeat-testing-europe {+yyyy.MM.dd}-000001}' as
ILM is enabled.
2019-09-30T14:06:28.410Z INFO [index-management] idxmgmt/std.go:399 Set setup.template.pattern to 'filebeat-testing-europe-*' as ILM is enabled.
2019-09-30T14:06:28.410Z INFO [index-management] idxmgmt/std.go:433 Set settings.index.lifecycle.rollover_alias in template to {filebeat-testing-eu
rope {+yyyy.MM.dd}-000001} as ILM is enabled.
2019-09-30T14:06:28.411Z INFO [index-management] idxmgmt/std.go:437 Set settings.index.lifecycle.name in template to {ilm-policy-filebeat-testing-e
urope {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2019-09-30T14:06:28.489Z INFO template/load.go:108 Try loading template filebeat-testing-europe to Elasticsearch
2019-09-30T14:06:28.804Z INFO template/load.go:100 template with name 'filebeat-testing-europe' loaded.
2019-09-30T14:06:28.804Z INFO [index-management] idxmgmt/std.go:289 Loaded index template.
2019-09-30T14:06:28.814Z INFO [index-management] idxmgmt/std.go:298 Write alias exists already
It seems like the setup.template.name is a concatenation of setup.ilm.rollover_alias and setup.ilm.pattern but with a space in between.
This looks wrong, doesn't it?
In kibana I can see an index filebeat-testing-europe and also my ilm policy named ilm-policy-filebeat-testing-europe.
However, there are no indices attached to the policy. Which makes somewhat sense, because filebeat decided to match on filebeat-testing-europe-*, but the index is just named filebeat-testing-europe.
hm...
so... according to the docs this should just work, but it doesn't. What am I doing wrong here?
Thanks in advance!