Hello all,
Been trying to set up ILM for our existing Logstash/filebeat deployments. I've successfully set it up for Logstash, but am having issues with Filebeat. Whenever I add the ILM settings to filebeat.yml, the index will no longer show in Elastic.
Filebeat.yml:
filebeat.inputs:
- type: log
# Change to true to enable this input configuration.
enabled: true
paths:
- "/var/log/filebeat*"
- "/app/CQF0/CONFLUENCE/CONFLUENCE-DATA/logs/*.log"
- "/app/CQF0/CONFLUENCE/CONFLUENCE-HOME/logs/attlassian*"
#============================= Filebeat modules ===============================
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
reload.period: 60s
#==================== Elasticsearch template setting ==========================
setup.template.settings:
index.number_of_shards: 3
setup.template.name: "cqf0-logs"
setup.template.pattern: "cqf0-*"
setup.template.overwrite: true
name: "DEV-LINUX-SERVER-LOGS"
#----------------------------- Elasticsearch output --------------------------------
output.elasticsearch:
hosts: ["{{ ES_HOST }}"]
username: ${ES_USR}
password: ${ES_PSW}
index: "cqf0-logs-%{+yyyy.MM.dd}"
ssl.verification_mode: none
ilm.enabled: true
ilm.rollover_alias: "cqf0-logs"
ilm.pattern: "cqf0-*"
Really not sure what the problem is. If I remove the last three lines, the index will show up (after a bit of a delay), but I need to get ILM working. Any help would be appreciated.
