Unable to do `filebeat setup ...` for custom `filebeat` index name

Elastic Stack Beats
1

I'm attempting to do a filebeat setup ... with Filebeat 7.16.0/Elasticsearch 7.16.2 for a custom index (foo-filebeat-7.16.0-*). However, it always loads the template, etc. for filebeat-7.16.0-*. I'm pretty sure this is a simple error in my config, but not certain what.

The command I'm using to do the setup is:

filebeat setup --strict.perms=false --index-management --pipelines --modules <list of modules> -e -d --path.config=$(pwd)

And my filebeat.yml is:

---
setup:
  kibana:
    host: '${KIBANA_URL}'
    protocol: 'https'
    username: '${USER}'
    password: '${PASSWORD}'
    ssl:
      enabled: true
      verification_mode: 'none'

  ilm:
    enabled: 'true'
    pattern: '000001'

  template:
    name: 'foo-filebeat'
    pattern: 'foo-filebeat-*'
    settings:
      index:
        final_pipeline: 'filebeat-final-pipeline'

output:
  elasticsearch:
    index: 'foo-filebeat-%{[agent.version]}'
    hosts:
      - '${ELASTICSEARCH_URL}'
    protocol: 'https'
    username: '${USER}'
    password: '${PASSWORD}'
    ssl:
      enabled: true
      verification_mode: 'none'

Additionally: Is there a way to add an alias to the initial template at the time it's uploaded? My setup script currently pulls the template from Elasticsearch after it's been uploaded by filebeat, adds the required aliases, and then loads it back into Elasticsearch.

2

I see the issue, according to this page:

image

I should be able to simply script a template download, update the template offline, then upload it and manually create the updated index. Not ideal, but workable.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.