Trying to setup Filebeat with ILM - enabling ILM seems to prevent index from appearing in Elastic

Elastic Stack Beats
,
1

Hello all,

Been trying to set up ILM for our existing Logstash/filebeat deployments. I've successfully set it up for Logstash, but am having issues with Filebeat. Whenever I add the ILM settings to filebeat.yml, the index will no longer show in Elastic.

Filebeat.yml:

filebeat.inputs:
      - type: log
      # Change to true to enable this input configuration.
        enabled: true
        paths:
          - "/var/log/filebeat*"
          - "/app/CQF0/CONFLUENCE/CONFLUENCE-DATA/logs/*.log"
          - "/app/CQF0/CONFLUENCE/CONFLUENCE-HOME/logs/attlassian*"
        
        #============================= Filebeat modules ===============================
        
      filebeat.config.modules:
        path: ${path.config}/modules.d/*.yml
        reload.enabled: false
        reload.period: 60s
        
        #==================== Elasticsearch template setting ==========================
        
      setup.template.settings:
        index.number_of_shards: 3
      setup.template.name: "cqf0-logs"
      setup.template.pattern: "cqf0-*"
      setup.template.overwrite: true
        
      name: "DEV-LINUX-SERVER-LOGS"
        #----------------------------- Elasticsearch output --------------------------------
      output.elasticsearch:
        hosts: ["{{ ES_HOST }}"]
        username: ${ES_USR}
        password: ${ES_PSW}
        index: "cqf0-logs-%{+yyyy.MM.dd}"
        ssl.verification_mode: none
        ilm.enabled: true
        ilm.rollover_alias: "cqf0-logs"
        ilm.pattern: "cqf0-*"

Really not sure what the problem is. If I remove the last three lines, the index will show up (after a bit of a delay), but I need to get ILM working. Any help would be appreciated.

2

Welcome to our community! :smiley:

What do your Filebeat logs show?

3

Hi there,

The logs don't show any errors, but I had a colleague try the same config on a Windows host (I'm handling the Linux hosts) and we ran into errors there. Should be able to sort them out. Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.