filebeat7.6.1修改索引名字後elasticsearch中沒有生成新索引

filebeat7.6.1修改索引名字後，比如下面這樣，shop-api xxx

<col>

1

2

3

4

5

​<code>​output.elasticsearch:​</code>​

​<code>​hosts: ["http://192.168.0.10:9200"]​</code>​

​<code>​index: "shop-api-%{[agent.version]}-%{+yyyy.MM.dd}"​</code>​

​<code>​setup.template.name: "shop-api"​</code>​

​<code>​setup.template.pattern: "shop-api-*"​</code>​

啟動後，發現在es中并沒有生成新的索引。

filebeat有列印下面的日志資訊

​<code>​2020-05-07T02:40:53.010Z    INFO    [index-management]  idxmgmt/std.go:258  Auto ILM enable success.​</code>​

​<code>​2020-05-07T02:40:53.012Z    INFO    [index-management.ilm]  ilm/std.go:139  do not generate ilm policy: exists=true, overwrite=false​</code>​

​<code>​2020-05-07T02:40:53.012Z    INFO    [index-management]  idxmgmt/std.go:271  ILM policy successfully loaded.​</code>​

​<code>​2020-05-07T02:40:53.012Z    INFO    [index-management]  idxmgmt/std.go:410  Set setup.template.name to '{filebeat-7.6.1 {now/d}-000001}' as ILM is enabled.​</code>​

提示開啟了ILM政策

翻官方文檔（https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html）後發現：

index配置部分中提示 The index setting is ignored when index lifecycle management is enabled

意思就是index設定的參數在索引生命周期管理（ilm）開啟後會忽略。

檢視ilm文檔 https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html 提示：

Starting with version 7.0, Filebeat uses index lifecycle management by default when it connects to a cluster that supports lifecycle management

從7.0版本開始，當elasticsearch支援生命周期管理時，filebeat預設使用索引生命周期管理，這樣就導緻自己修改的日志檔案名無效了。

關閉ilm功能即可(setup.ilm.enabled: false)。

6

7

8

9

10

11

12

13

14

15

16

17

18

​<code>​[root@node1 shop-api]# cat filebeat.yml​</code>​

​<code>​filebeat.inputs:​</code>​

​<code>​- type: log​</code>​

​<code>​paths:​</code>​

​<code>​- /mnt/logs/*.log​</code>​

​<code>​fields:​</code>​

​<code>​java: true​</code>​

​<code>​fields_under_root: true​</code>​

​<code>​multiline.pattern: '^[0-9]{2}:[0-9]{2}:[0-9]{2}.* \[http-nio'​</code>​

​<code>​multiline.negate: true​</code>​

​<code>​multiline.match: after​</code>​

​<code>​setup.ilm.enabled: false​</code>​

​