Too many fields lost after use customized index name

Elastic Stack Beats
1

hello

I'm using Metricbeat 5.4.0 and everything kept in default except index name in out>elasticsearch section
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["10.0.96.166:9200"]
index: "portal-metric-%{+yyyy.MM}"
# Optional protocol and basic auth credentials.
protocol: "http"
username: "elastic"
password: "changeme"

I add above configuration index: "portal-metric-%{+yyyy.MM}" and create index pattern portal-metric-* in kibana, this pattern has only about 100 fields.

while if I remove index: "portal-metric-%{+yyyy.MM}" to use default index name like metricbeat-%{+yyyy.MM.dd} it will has about 757 fields.

I don't know why. and I also tried to set template while use customized index name, it's not work either

2

You may need to edit your metricbeat.template.json and adapt it to your index:

Change "template": "metricbeat-*" to "template": "portal-metrics-*"

Then it your index should get the template right and get all defined fields

3

thank you for your reply.

i tried that, it's not take effect. and I think "template": "portal-metrics-*" in metricbeat.template.json is just
the template name.

4

The template field is used to match new indexes: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

Have you tried to recreate the index after loading the new template?

5

This topic was automatically closed after 21 days. New replies are no longer allowed.