Beats: Index template in elasticsearch overwritten with default settings setup.template.overwrite=false

[magicpotion]

Elasticsearch version: 7.5.2 elasticloud,
Beats version: 7.5.2 Winlogbeat, Filebeat, Metricbeat

Description of the problem including expected versus actual behavior:

Documentation is quite clear about it:

setup.template.overwrite
A boolean that specifies whether to overwrite the existing template. The default is false.

yet my index templates with the same name and index pattern are being overwritten, as seen in logs:

[instance-0000000011] adding template [winlogbeat-7.5.2-blabla] for index patterns [winlogbeat-7.5.2-blabla-*]

Sending data directly from Beats with mostly default configuration, no setup.template.ovewrite, believing the default would be false, relevant custom template settings are these:

setup.template.name: "filebeat"  
setup.template.pattern: "filebeat-*"  
setup.ilm.rollover_alias: "filebeat-%{[agent.version]}-${STORE,,}"

I see an issue related to this a year ago, but the issue still exists in 7.5.2:
https://github.com/elastic/beats/pull/11671

[elasticmachine]

Pinging @elastic/integrations-services (Team:Services)

[ycombinator]

Hi @magicpotion, the issue is that when ILM is enabled (which is the default in 7.x), the template name and index pattern defined in the template are governed by the ILM rollover alias instead of setup.template.name and setup.template.pattern respectively. This is, unfortunately, not documented well at the moment but it's something we're working to fix. See https://github.com/elastic/beats/issues/11866#issuecomment-589936554 for a more in-depth explanation.

As a workaround you could set setup.ilm.enabled: false but then, of course, Filebeat indices will not use the ILM feature in Elasticsearch.

[collinbachi]

@ycombinator how does that address the issue of the index being overwritten in the first place?

Why is setup.template.overwrite: false being ignored?

[gelele]

@ycombinator how does that address the issue of the index being overwritten in the first place?

Why is setup.template.overwrite: false being ignored?

just met the same problem. Index template was overwritten by filebeat with setup.template.overwrite= false