# Trying to setup Filebeat with ILM - enabling ILM seems to prevent index from appearing in Elastic

**URL:** https://discuss.elastic.co/t/trying-to-setup-filebeat-with-ilm-enabling-ilm-seems-to-prevent-index-from-appearing-in-elastic/273211
**Category:** Beats
**Tags:** ilm-index-lifecycle-management, filebeat
**Created:** [May 17, 2021, 5:57pm UTC](https://discuss.elastic.co/t/trying-to-setup-filebeat-with-ilm-enabling-ilm-seems-to-prevent-index-from-appearing-in-elastic/273211 "2021-05-17T17:57:07Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![aidenosi](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@aidenosi](https://discuss.elastic.co/u/aidenosi)
#### Post date: [May 17, 2021, 5:57pm UTC](https://discuss.elastic.co/t/trying-to-setup-filebeat-with-ilm-enabling-ilm-seems-to-prevent-index-from-appearing-in-elastic/273211/1 "2021-05-17T17:57:07Z")

</div>

Hello all,

Been trying to set up ILM for our existing Logstash/filebeat deployments. I've successfully set it up for Logstash, but am having issues with Filebeat. Whenever I add the ILM settings to filebeat.yml, the index will no longer show in Elastic.

Filebeat.yml:

```auto
filebeat.inputs:
      - type: log
      # Change to true to enable this input configuration.
        enabled: true
        paths:
          - "/var/log/filebeat*"
          - "/app/CQF0/CONFLUENCE/CONFLUENCE-DATA/logs/*.log"
          - "/app/CQF0/CONFLUENCE/CONFLUENCE-HOME/logs/attlassian*"
        
        #============================= Filebeat modules ===============================
        
      filebeat.config.modules:
        path: ${path.config}/modules.d/*.yml
        reload.enabled: false
        reload.period: 60s
        
        #==================== Elasticsearch template setting ==========================
        
      setup.template.settings:
        index.number_of_shards: 3
      setup.template.name: "cqf0-logs"
      setup.template.pattern: "cqf0-*"
      setup.template.overwrite: true
        
      name: "DEV-LINUX-SERVER-LOGS"
        #----------------------------- Elasticsearch output --------------------------------
      output.elasticsearch:
        hosts: ["{{ ES_HOST }}"]
        username: ${ES_USR}
        password: ${ES_PSW}
        index: "cqf0-logs-%{+yyyy.MM.dd}"
        ssl.verification_mode: none
        ilm.enabled: true
        ilm.rollover_alias: "cqf0-logs"
        ilm.pattern: "cqf0-*"

```

Really not sure what the problem is. If I remove the last three lines, the index will show up (after a bit of a delay), but I need to get ILM working. Any help would be appreciated.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 17, 2021, 10:56pm UTC](https://discuss.elastic.co/t/trying-to-setup-filebeat-with-ilm-enabling-ilm-seems-to-prevent-index-from-appearing-in-elastic/273211/2 "2021-05-17T22:56:42Z")

</div>

Welcome to our community! 😃

What do your Filebeat logs show?

---

<div class="post-metadata">

### Author: ![aidenosi](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@aidenosi](https://discuss.elastic.co/u/aidenosi)
#### Post date: [May 19, 2021, 2:32pm UTC](https://discuss.elastic.co/t/trying-to-setup-filebeat-with-ilm-enabling-ilm-seems-to-prevent-index-from-appearing-in-elastic/273211/3 "2021-05-19T14:32:51Z")

</div>

Hi there,

The logs don't show any errors, but I had a colleague try the same config on a Windows host (I'm handling the Linux hosts) and we ran into errors there. Should be able to sort them out. Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 16, 2021, 4:33pm UTC](https://discuss.elastic.co/t/trying-to-setup-filebeat-with-ilm-enabling-ilm-seems-to-prevent-index-from-appearing-in-elastic/273211/4 "2021-06-16T16:33:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
