Template keep adding itself in loop

[stack]

Hello,

I have setup a template trough my winlogbeat file and i wanted to update it on Kibana by adding an alias. Everytime i added the alias i noticed that the change would apply, but 5 seconds later it would disappeir.

Turn out that one of my node keep re-adding the template every 5 seconds, overwriting my changes (seeing it on the cmd console of elasticsearch, i'm running it on windows) . I tried rebooting my nodes but it still happend. I deleted the template and updated my winlogbeat conf file to

setup.template.overwrite: false

as part of :

setup.template.enabled: true
setup.template.overwrite: false
setup.template.name: "winlogbeat"
setup.template.pattern: "winlogbeat-*"
setup.ilm.enabled: false
setup.ilm.policy_name: "winlogbeat-hot-warm-30daysoflogs"
setup.ilm.rollover_alias: "winlogbeat-alias"
setup.ilm.pattern: "{now/d{dd.MM.yyyy}}-000001"
setup.ilm.check_exists: false

And made the setup again. However template keep overwriting in loop. I couldn't find help on that subject, do you guys have an idea ?

Thank you !

[warkolm (Mark Walkom)]

Can you share the template and the log lines you are seeing of this behaviour?

[stack]

Hello,

I made a screenshot of the log output from console:
https://i.imgur.com/ui0Zedd.png

The template is the default winlogbeat template, i'm only changing it's name because i changed my index name to be winlogbeat only (no beat version in the index).

[warkolm (Mark Walkom)]

Please don't post pictures of text, they are difficult to read, impossible to search and some people may not be even able to see them

Can you post the template? Feel free to use gist/pastebin/etc.

[stack]

Sorry for the picture, it seemed easier to me

[2020-03-06T11:38:48,506][INFO ][o.e.c.m.MetaDataIndexTemplateService] [ELK001] adding template [winlogbeat] for index patterns [winlogbeat-*]
[2020-03-06T11:38:53,302][INFO ][o.e.c.m.MetaDataIndexTemplateService] [ELK001] adding template [metricbeat] for index patterns [metricbeat-*]
[2020-03-06T11:38:56,819][DEBUG][o.e.a.s.m.TransportMasterNodeAction] [ELK001] Get stats for datafeed '_all'
[2020-03-06T11:39:01,081][INFO ][o.e.c.m.MetaDataIndexTemplateService] [ELK001] adding template [winlogbeat] for index patterns [winlogbeat-*]
[2020-03-06T11:39:06,788][DEBUG][o.e.a.s.m.TransportMasterNodeAction] [ELK001] Get stats for datafeed '_all'
[2020-03-06T11:39:07,879][INFO ][o.e.c.m.MetaDataIndexTemplateService] [ELK001] adding template [metricbeat] for index patterns [metricbeat-*]
[2020-03-06T11:39:16,717][INFO ][o.e.c.m.MetaDataIndexTemplateService] [ELK001] adding template [winlogbeat] for index patterns [winlogbeat-*]
[2020-03-06T11:39:16,795][DEBUG][o.e.a.s.m.TransportMasterNodeAction] [ELK001] Get stats for datafeed '_all'
[2020-03-06T11:39:22,818][INFO ][o.e.c.m.MetaDataIndexTemplateService] [ELK001] adding template [winlogbeat] for index patterns [winlogbeat-*]
[2020-03-06T11:39:23,053][INFO ][o.e.c.m.MetaDataIndexTemplateService] [ELK001] adding template [metricbeat] for index patterns [metricbeat-*]
[2020-03-06T11:39:26,769][DEBUG][o.e.a.s.m.TransportMasterNodeAction] [ELK001] Get stats for datafeed '_all'
[2020-03-06T11:39:28,007][INFO ][o.e.c.m.MetaDataIndexTemplateService] [ELK001] adding template [metricbeat] for index patterns [metricbeat-*]

Here's the template https://pastebin.com/ZNANasPZ

This is the first time i open this file, first thing i notice on top is the index pattern: winlogbeat.7.5.1 which in my conf file isn't what i want anymore. Could it be the root cause ?

[stack]

I decided to move all my nodes to CentOS since i was having lot of issues with Windows and i realised i had no advantages from being on Windows.

On my new cluster i can see that my agents still override my template on a regularer bassis.

However, it doesn't matter anymore because i decided to not use custom index/template anymore, juste use the default template. This way, my agents may keep overiding the template, it doesn't matter because i don't need to make any changes to that template.