Topbeat index name appends YYYY.MM.DD

Elastic Stack Beats
1

Hi Chaps

I've just started out with topbeats and imported the visualisations from github. Perhaps I've missed something, but as visualisations are tied to an index and topbeat automatically appends the date to each index daily, how are you supposed to maintain visualisations with importing/creating daily? Currently I'm skipping logstash and importing direct to ES.

My preference is to have indexes follow my current log index patterns which is [proj_name-environment_name-stats_name] e.g. "cust1-uat-topbeat". "cust1-uat-logs"

Have I missed a setting somewhere? I'd like to force beats to use the EXACT config.yml specified index.

Many thanks

Ross

2

It does this because it's easy to know which index to go to for data, and also for retention.
It's easier to drop an index that is N days old, rather than delete data from N days ago in a multiday index.

3

Thanks Mark.

I've also just realised that in Kibana I can tie a dashboard and visualisations to a index mask vs specific index so part of my problem has gone away.

4

You can also use aliases in elasticsearch and use the alias from kibana if this helps.

5

From this comment, I assume there is no way to control topbeat from appending the YYYY.MM.DD?

6

Currently you cannot configure the index pattern in Elasticsearch, but there is already a PR opened, that you can follow.
Please also notice that Topbeat is replaced with Metricbeat in 5.0. Please read more in the blog post.