Unable to change index name for Filebeat

Elastic Stack Beats
1

Hello,

I am trying to change index name for filebeat configuration and it still complain about missing template name and pattern.

After googling and checking documentation I have finished with this configration syntax:
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]
index: "api-access-%{+yyyy.MM.dd}"
setup.template.enabled: false
setup.template.name: "api-access"
setup.template.pattern: "api-access-*"

But still getting
2018-03-07T13:28:22.437Z INFO instance/beat.go:475 Beat UUID: 36ef92e0-ca53-4d4b-a7b8-0ec3c105eb62
2018-03-07T13:28:22.437Z INFO instance/beat.go:213 Setup Beat: filebeat; Version: 6.2.2
2018-03-07T13:28:22.437Z ERROR instance/beat.go:667 Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified.
Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified.

Any idea what I am doing wrong?

Thank you,

Reddy

2

It seems that you have an indentation error in your configuration.

This works for me:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  index: "api-access-%{+yyyy.MM.dd}"
setup.template:
  name: 'api-access'
  pattern: 'api-access-*'
  enabled: false
1 Like
3

Why would setup.template.enabled be false?

Be sure to have created the index template in elasticsearch - I think you have to go through the API to do so. https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.