Unable to setup template name about events-api-elastic

[anthonythleung]

Hi @lexyiouroukis!

From the config file, it looks like you have ILM enabled. With ILM enabled, setup.template.name and setup.template.pattern are ignored. Instead, you'll have to setup the template name with setup.ilm.rollover_alias and setup.ilm.pattern (https://www.elastic.co/guide/en/beats/filebeat/7.15/ilm.html#setup-ilm-rollover_alias-option).

For reference, here is the config with ILM enabled that's working for me:

eventsapibeat:
  insecure_skip_verify: false
  signin_attempts:
    enabled: true
    auth_token: "..."
    sample_frequency: "10s"
    cursor_state_file: "signinattempts.eventsapibeatstate"
    starting_cursor: >
      { "limit": 1000, "start_time": "2020-10-10T00:00:00Z" }
  item_usages:
    enabled: true
    auth_token: "..."
    sample_frequency: "10s"
    cursor_state_file: "itemusages.eventsapibeatstate"
    starting_cursor: >
      { "limit": 1000, "start_time": "2020-10-10T00:00:00Z" }
output.elasticsearch:
  hosts: [...]
  api_key: "..."
setup.ilm.enabled: true
setup.ilm.policy_name: "365-days-default"
setup.ilm.rollover_alias: "onepassword-logs%{[agent.version]}"

Let me know if this works for you!