Unable to setup template name

[lexyiouroukis]

When deploying the 1password eventsbeatapi.yaml I've setup the following:

---
eventsapibeat:
  insecure_skip_verify: false
  signin_attempts:
    enabled: true
    auth_token: "${AUTH_TOKEN}"
    sample_frequency: "10s"
    cursor_state_file: "signinattempts.eventsapibeatstate"
    starting_cursor: >
      { "limit": 1000, "start_time": "2022-02-24T00:00:00Z" }
  item_usages:
    enabled: true
    auth_token: "${AUTH_TOKEN}"
    sample_frequency: "10s"
    cursor_state_file: "itemusages.eventsapibeatstate"
    starting_cursor: >
      { "limit": 1000, "start_time": "2022-02-24T00:00:00Z" }
output.elasticsearch:
  hosts: ["${ES_HOSTS}"]
  index: "onepassword-logs%{[agent.version]}"
  password: "${ES_PASSWORD}"
  username: "${ES_USERNAME}"
  ssl:
      certificate_authorities:
      - ""
setup.ilm.enabled: true
setup.template.name: "onepassword-logs%{[agent.version]}"
setup.template.pattern: "onepassword-logs%{[agent.version]}"
index.aliases: "onepassword-logs%{[agent.version]}"
setup.ilm.policy_name: "${POLICY}"

When I go to add the index pattern in Kibana the only index that appears is eventsbeatapi even though from my knowledge of filebeat adding the output.elasticsearch.index should resolve this yet seemingly ignores this. Any insight is greatly appreciated.

[anthonythleung]

Hi @lexyiouroukis!

From the config file, it looks like you have ILM enabled. With ILM enabled, setup.template.name and setup.template.pattern are ignored. Instead, you'll have to setup the template name with setup.ilm.rollover_alias and setup.ilm.pattern (https://www.elastic.co/guide/en/beats/filebeat/7.15/ilm.html#setup-ilm-rollover_alias-option).

For reference, here is the config with ILM enabled that's working for me:

eventsapibeat:
  insecure_skip_verify: false
  signin_attempts:
    enabled: true
    auth_token: "..."
    sample_frequency: "10s"
    cursor_state_file: "signinattempts.eventsapibeatstate"
    starting_cursor: >
      { "limit": 1000, "start_time": "2020-10-10T00:00:00Z" }
  item_usages:
    enabled: true
    auth_token: "..."
    sample_frequency: "10s"
    cursor_state_file: "itemusages.eventsapibeatstate"
    starting_cursor: >
      { "limit": 1000, "start_time": "2020-10-10T00:00:00Z" }
output.elasticsearch:
  hosts: [...]
  api_key: "..."
setup.ilm.enabled: true
setup.ilm.policy_name: "365-days-default"
setup.ilm.rollover_alias: "onepassword-logs%{[agent.version]}"

Let me know if this works for you!