setup.dashboard.index should respect elasticsearch.output.index

[jordansissel]

Tested on auditbeat 6.2.4

When setting elasticsearch.output.index, the default setup.dashboard.index pattern that gets used is still auditbeat-*.

Here's the scenario I went through:

When changing the index name:

output.elasticsearch:
  index: "foo"

Beats setup will tell me:

Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified.

So I follow the instructions:

setup:
  template.name: "auditbeat"
  template.pattern: "*-auditbeat-*"

Then run setup again:

# auditbeat setup -c /tmp/auditbeat.yml -e
...
2018-04-23T23:10:09.706Z        INFO    instance/beat.go:583    Kibana dashboards successfully loaded.

However, when viewing the dashboards, all the dashboards/visuals appear to point at auditbeat-* instead of my configured *-auditbeat-*.

To work around this, I added:

setup:
  template.name: "auditbeat"
  template.pattern: "*-auditbeat-*"
  template.enabled: true
  dashboards.index: "*-auditbeat-*"   # this is required.

[Dumbaz]

I can confirm this behavour with filebeat version 6.4.2 (amd64), libbeat 6.4.2 [e193f6d68b25b7ddbe3a3ed8d60bc07fea1ef800 built 2018-09-26 12:42:46 +0000 UTC]

Would like to see this improved as well.

[RealLinkers]

This is still a thing on 7.2.0, I am unable to populate the kibana custom index pattern, although it does show the correct index on visualization.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic]

This issue doesn't have a Team:<team> label.

[kvch]

Fixed by #17749
Feel free to reopen if the problem persist on newer versions.