When you run setup on auditbeat (and perhaps others), it tells you that if you want to overwrite the ILM policy, you need to add a configuration option. The problem is that the message does not include a space after the colon, which is invalid YAML

$ sudo auditbeat setup
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling.

If a user follows this instr

我修改了config.filebeat
cat >> $FILEBEAT_CONFIG << EOF
$(base)
output.elasticsearch:
hosts: [$ELASTICSEARCH_HOSTS]
index: ${ELASTICSEARCH_INDEX:-filebeat}-%{+yyyy.MM}
${ELASTICSEARCH_SCHEME:+protocol: ${ELASTICSEARCH_SCHEME}}
${ELASTICSEARCH_USER:+username: ${ELASTICSEARCH_USER}}
${ELASTICSEARCH_PASSWORD:+password: ${ELASTICSEARCH_PASSWORD}}
${ELASTICSEARCH_WORKER:+wor

https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html#_special_requirements

PID and CAP_ADD options are ignored as they are not yet available in swarm mode. Might be available in mid 2019

Feature idea, add beat info metrics from the stats endpoint /

{
  "beat": "pubsubbeat",
  "hostname": "pubsub-sidekiq-inf-gstg",
  "name": "pubsub-sidekiq-inf-gstg",
  "uuid": "FOO",
  "version": "7.5.1"
}

Would make a metrics like this:

pubsubbeat_build_info{version="7.5.1"} 1
pubsubbeat_beat_info{beat_name="pubsub-sidekiq-inf-gstg",uuid="FOO",} 1

When I use the following prospector section in the manifest file
filebeat::prospector { 'syslog': paths => [ '/var/log/messages','/var/log/secure' ], fields_under_root => true, fields => {'type' => 'syslog'}, }
the generated filebeat prospector config has got document_type: log which is not required.
and filebeat log still complaining about document_

Currently, the Stack Monitoring parity tests use a trial license. This is necessary to collect monitoring stats for certain stack features like CCR.

However, there are a few differences in the collected monitoring data (e.g. the license field in type: cluster_stats documents in .monitoring-es-*) when a Basic license is in use on the monitored cluster instead of a Trial license. To accou