Filebeat setup ILM with template and custom name - elasticsearch

Question

Using ES toolchain in version 7.17.0
I'd like to setup ILM + index_template with customised name.
However from documentation
If index lifecycle management is enabled (which is typically the default), setup.template.name and setup.template.pattern are ignored.
It seems like it's not possible.
Now the questions:
is it ok to setup custom template name (with custom setup) when ILM is/was enabled?
is it ok to run two setup files in filebeat? (e.g. filebeat setup --index-management --dashboards -c setup-ilm.yml && filebeat setup --index-management --dashboards -c setup-template.yml)?
am I able to put those setup files somewhere in filebeat (docker image) to be execute automatically? I've seen that there is only modules and inputs folder setup.
when I've executed those setup files above I've seen following:
Loading ILM policy and write alias without loading template is not recommended. Check your configuration.
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
ILM policy and write alias loading not enabled.
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
setup-ilm.yml
setup:
ilm:
enabled: true
policy_file: "ilm-policy.json"
template:
enabled: false
output.elasticsearch:
hosts: ["elasticsearch:9200"]
setup-template.yml
setup:
ilm:
enabled: false
template:
enabled: true
name: "${ES_NAMESPACE:+${ES_NAMESPACE}-}filebeat-%{[agent.version]}"
pattern: "${ES_NAMESPACE:+${ES_NAMESPACE}-}filebeat-%{[agent.version]}-*"
kibana:
host: "kibana:5601"
index:
number_of_shards: 1
mapping:
total_fields:
limit: 5000
output.elasticsearch:
hosts: ["elasticsearch:9200"]

Answer 1

This is how I did to have custom index name + lifecycle policy, I'm using the elastic operators from ECK so if it's not your case it may be different. So, assuming ECK and elastic are already installed this is my beats yaml file:
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
name: filebeat
spec:
type: filebeat
version: 8.6.0
config:
filebeat:
autodiscover:
providers:
- type: kubernetes
node: ${NODE_NAME}
hints:
enabled: true
default_config:
type: container
paths:
- /var/log/containers/*${data.kubernetes.container.id}.log
output:
elasticsearch:
index: "custom-name-%{[agent.version]}-%{+yyyy.MM.dd}"
hosts: [ "elastic-host:9200" ]
username: "filebeat_user"
password: "password" # pending to load from secret
ssl:
verification_mode: "none"
setup:
template:
name: "filebeat"
pattern: "*-filebeat-*"
processors:
- add_cloud_metadata: {}
- add_host_metadata: {}
daemonSet:
podTemplate:
spec:
serviceAccountName: filebeat
automountServiceAccountToken: true
terminationGracePeriodSeconds: 30
dnsPolicy: ClusterFirstWithHostNet
hostNetwork: true # Allows to provide richer host metadata
containers:
- name: filebeat
securityContext:
runAsUser: 0
volumeMounts:
- name: varlogcontainers
mountPath: /var/log/containers
- name: varlogpods
mountPath: /var/log/pods
- name: varlibdockercontainers
mountPath: /var/lib/docker/containers
env:
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
volumes:
- name: varlogcontainers
hostPath:
path: /var/log/containers
- name: varlogpods
hostPath:
path: /var/log/pods
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: filebeat
rules:
- apiGroups: [""] # "" indicates the core API group
resources:
- namespaces
- pods
- nodes
verbs:
- get
- watch
- list
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: filebeat
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: filebeat
subjects:
- kind: ServiceAccount
name: filebeat
roleRef:
kind: ClusterRole
name: filebeat
apiGroup: rbac.authorization.k8s.io
As I understood, this will create an index template called filebeat that match the pattern *-filebeat-* and a policy for that index called filebeat. This is the important part:
output:
elasticsearch:
index: "custom-name-%{[agent.version]}-%{+yyyy.MM.dd}"
hosts: [ "elastic-host:9200" ]
username: "filebeat_user"
password: "password" # pending to load from secret
ssl:
verification_mode: "none"
setup:
template:
name: "filebeat"
pattern: "*-filebeat-*"
I hope this helps because is poorly documented, they even have an open issue to improve the documentation: https://github.com/elastic/beats/issues/11866