how to set correct timestring in metricbeat index?

508 Views Asked by At

I was trying to set a custom metricbeat index in elasticsearch indices.

When I add like below to metricbeat.yml file

        index: "metricbeat-%{[agent.version]}-%{+yyyy-MM-dd}"
      setup.template:
        name: "metricbeat"
        pattern: "metricbeat-%{[agent.version]}-%{+yyyy-MM-dd}"

The index generated is metricbeat-7.8.0-2021.03.11-000001. But the timestring '%Y.%m.%d' in curator is not matching it and not able to clear the indices.

How to make the index from metricbeat-7.8.0-2021.03.11-000001 to metricbeat-7.8.0-2021.03.11?

I even tried like this

        index: "metricbeat-{now/d}"
      setup.template:
        name: "metricbeat"
        pattern: "metricbeat-{now/d}"

But same patter of index. Please help with this.

Update:

Curator config

Data
====
action_file.yml:
----
---
actions:
  1:
    action: delete_indices
    description: "Clean up ES by deleting old indices"
    options:
      timeout_override:
      continue_if_exception: False
      disable_action: False
      ignore_empty_list: True
    filters:
    - filtertype: pattern
      kind: regex
      value: '^(metricbeat-).*$'
    - filtertype: age
      source: name
      direction: older
      timestring: '%Y.%m.%d'
      unit: days
      unit_count: 7
      field:
      stats_result:
      epoch:
      exclude: False
config.yml:
----
---
client:
  hosts:
    - elasticsearch-master.paas.svc
  port: 9200
  # url_prefix:
  # use_ssl: True
  # certificate:
  # client_cert:
  # client_key:
  # ssl_no_validate: True
  # http_auth:
  # timeout: 30
  # master_only: False
logging:
  loglevel: DEBUG
#   logfile:
#   logformat: default
#   blacklist: ['elasticsearch', 'urllib3']
1

There are 1 best solutions below

0
On

The index pattern metricbeat-7.8.0-2021.03.11-000001 indicates that metricbeat is using rollover indices. It is affixing the date when the index was created, and an incrementing number. This also means that you likely have an ILM policy affixed to your rollover indices. As such, you should read about ILM and Curator in the documentation. To correct these indices being filtered, you have to add allow_ilm_indices: true to the options in your configuration.