0

I am using the ELK stack (more ELG stack as I am using Grafana as the front end instead of kibana for personal reasons). I am using Filebeat to send the logs file to Logstash which are then stored in Elasticsearch and displayed through Grafana. I have used this guide for the setup.

Now when I have added another path in the filebeat.yml configuration file and then deleted the previous indices in Elasticsearch and then loaded the template again through the following command,

filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'

the index is not registered in elasticsearch and

curl -XGET http://127.0.0.1:9200/_cat/indices?v

shows no index in Elasticsearch. After checking the Filebeat logs I found the following error:

2018-06-05T10:08:32.228+0500 INFO instance/beat.go:468 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2018-06-05T10:08:32.229+0500 INFO instance/beat.go:475 Beat UUID: edf1a2c9-0d7d-4c8a-9823-30bf64b72a4f
2018-06-05T10:08:32.229+0500 INFO instance/beat.go:213 Setup Beat: filebeat; Version: 6.2.4
2018-06-05T10:08:32.229+0500 INFO elasticsearch/client.go:145 Elasticsearch url: http://localhost:9200
2018-06-05T10:08:32.230+0500 INFO pipeline/module.go:76 Beat name: vbras
2018-06-05T10:08:32.231+0500 INFO elasticsearch/client.go:145 Elasticsearch url: http://localhost:9200
2018-06-05T10:08:32.245+0500 INFO elasticsearch/client.go:690 Connected to Elasticsearch version 6.2.4

2018-06-05T10:08:32.249+0500 INFO template/load.go:73 Template already exists and will not be overwritten.

How can I resolve this issue?

0

From latest version documentation, it is possible to replace index template with following configuration keys:

setup.template.overwrite: true
setup.template.enabled: true

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.