beats直接给es传输日志,自定义索引名
新版本的beats默认配置开启了ILM,导致索引命名规则被ILM策略控制。
加上这个配置就好了
filebeat 配置关闭 ILM 即可解决Index Pattern不生效的问题
setup.ilm.enabled: false
具体配置:
#==================== Elasticsearch template setting ========================== setup.ilm.enabled: false setup.template.name: "filebeat" setup.template.pattern: "filebeat-*" setup.template.settings: index.number_of_shards: 1 index.number_of_replicas: 0 index.codec: best_compression #-------------------------- Elasticsearch output ------------------------------ output.elasticsearch: hosts: ["127.0.0.1:9200"] index: "filebeat-127-%{+yyyy.MM.dd}" username: "elastic" password: "xxxxxxxxxxx"