I was trying to set a custom metricbeat index in elasticsearch indices.
When I add like below to metricbeat.yml file
index: "metricbeat-%{[agent.version]}-%{+yyyy-MM-dd}"
setup.template:
name: "metricbeat"
pattern: "metricbeat-%{[agent.version]}-%{+yyyy-MM-dd}"
The index generated is metricbeat-7.8.0-2021.03.11-000001
. But the timestring '%Y.%m.%d'
in curator is not matching it and not able to clear the indices.
How to make the index from metricbeat-7.8.0-2021.03.11-000001
to metricbeat-7.8.0-2021.03.11
?
I even tried like this
index: "metricbeat-{now/d}"
setup.template:
name: "metricbeat"
pattern: "metricbeat-{now/d}"
But same patter of index. Please help with this.
Update:
Curator config
Data
====
action_file.yml:
----
---
actions:
1:
action: delete_indices
description: "Clean up ES by deleting old indices"
options:
timeout_override:
continue_if_exception: False
disable_action: False
ignore_empty_list: True
filters:
- filtertype: pattern
kind: regex
value: '^(metricbeat-).*$'
- filtertype: age
source: name
direction: older
timestring: '%Y.%m.%d'
unit: days
unit_count: 7
field:
stats_result:
epoch:
exclude: False
config.yml:
----
---
client:
hosts:
- elasticsearch-master.paas.svc
port: 9200
# url_prefix:
# use_ssl: True
# certificate:
# client_cert:
# client_key:
# ssl_no_validate: True
# http_auth:
# timeout: 30
# master_only: False
logging:
loglevel: DEBUG
# logfile:
# logformat: default
# blacklist: ['elasticsearch', 'urllib3']
The index pattern
metricbeat-7.8.0-2021.03.11-000001
indicates that metricbeat is using rollover indices. It is affixing the date when the index was created, and an incrementing number. This also means that you likely have an ILM policy affixed to your rollover indices. As such, you should read about ILM and Curator in the documentation. To correct these indices being filtered, you have to addallow_ilm_indices: true
to theoptions
in your configuration.