elasticsearch - 未在Filebeat中将索引名称设置为Elasticsearch-ELK .NET Docker ElasticHQ

Question

我正在试验一些已经按照json格式化的Elasticsearch，所以我直接从Filebeat转到Elasticsearch，而不是通过Logstash。这是使用docker-compose:

version: '2.2'
services:
  elasticsearch:
    container_name: elasticsearch
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
    ports:
      - 9200:9200
      - 9300:9300
    environment:
      - discovery.type=single-node
      - cluster.name=docker-
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    networks:
      - esnet
  filebeat:
    container_name: filebeat
    build:
      context: .
      dockerfile: filebeat.Dockerfile
    volumes:
      - ./logs:/var/log
      - ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml
    networks:
      - esnet  
  elastichq:
    container_name: elastichq
    image: elastichq/elasticsearch-hq
    ports:
      - 8080:5000
    environment:
      - HQ_DEFAULT_URL=http://elasticsearch:9200
      - HQ_ENABLE_SSL=False
      - HQ_DEBUG=FALSE
    networks:
      - esnet  
networks:
  esnet: 

但是，当我打开 ElasticHQ时，索引名称已被标记为带有日期戳的 filebeat-7.5.2-2020.02.10-000001。我已在 index中将 Sample名称指定为 filebeat.yml。我是否缺少某些东西，或者这种行为正常吗？

这是我的 filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.json
  json.keys_under_root: true
  json.add_error_key: true 

#----------------------------- Elasticsearch output --------------------------------

output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  index: "sample-%{+YYYY.MM.dd}"


setup.template.name: "sample"
setup.template.pattern: "sample-*"

知道预定义的内容会更实际，因此，如果我使用Postman而不是ElasticHQ，则可以开始查询数据而不必查找 index名称。

Answer 1

我认为Filebeat ILM可能取代了已配置的索引名称。

Starting with version 7.0, Filebeat uses index lifecycle management by default when it connects to a cluster that supports lifecycle management. Filebeat loads the default policy automatically and applies it to any indices created by Filebeat.

并且当启用ilm时，将忽略Filebeat Elasticsearch output索引设置

The index setting is ignored when index lifecycle management is enabled. If you’re sending events to a cluster that supports index lifecycle management, see Configure index lifecycle management to learn how to change the index name.

您可能需要禁用ILM或更好地使用ILM rollover_alias配置所需的文件名。