Customize Elasticsearch index generation

Big Bang generates separate Elasticsearch outputs for container and host records, with logstash-style index names and a node prefix for host records. Changing their index naming requires replacing the complete output configuration under the package’s upstream passthrough parent. In canonical umbrella configuration, this parent is packages.fluentbit.values.upstream with packageConfiguration.version: v1; legacy configuration uses fluentbit.values.upstream.

Use the upstream Elasticsearch output documentation for date formatting and other plugin behavior. Consult the bundled chart values for the configuration entry point. Do not assume changing one output appends to the generated outputs.

Preserve all destinations, record matches, credential environment references, TLS verification, certificate paths and queue limits required by the installation. The default in-cluster Elasticsearch connection depends on Secrets provisioned in the collector namespace. Disabling umbrella defaults also suppresses generated credential/mount wiring: provide replacements, not just an output stanza. Verify actual rendered configuration and backend records before accepting an index change.

Return to the destination and credential guidance.

Example: hourly indexes

These package values replace both default Elasticsearch outputs and change the date suffix to %Y.%m.%d-%H. They assume the default Big Bang Elasticsearch release, its HTTPS listener, synchronized password/CA Secrets, and the umbrella’s generated environment and certificate mounts. Keep additionalOutputs.disableDefault: false so that wiring is retained:

additionalOutputs:
  disableDefault: false
upstream:
  config:
    outputs: |
      [OUTPUT]
          Name es
          Match kube.*
          Host logging-ek-es-http.logging
          Port 9200
          HTTP_User elastic
          HTTP_Passwd ${FLUENT_ELASTICSEARCH_PASSWORD}
          Logstash_Format On
          Logstash_DateFormat %Y.%m.%d-%H
          Suppress_Type_Name On
          Retry_Limit False
          Replace_Dots On
          tls On
          tls.verify On
          tls.ca_file /etc/elasticsearch/certs/ca.crt
          net.keepalive Off
          storage.total_limit_size 10G
      [OUTPUT]
          Name es
          Match host.*
          Host logging-ek-es-http.logging
          Port 9200
          HTTP_User elastic
          HTTP_Passwd ${FLUENT_ELASTICSEARCH_PASSWORD}
          Logstash_Format On
          Logstash_Prefix node
          Logstash_DateFormat %Y.%m.%d-%H
          Suppress_Type_Name On
          Retry_Limit False
          tls On
          tls.verify On
          tls.ca_file /etc/elasticsearch/certs/ca.crt
          net.keepalive Off
          storage.total_limit_size 10G

This is a complete output string for an Elasticsearch-only deployment, not an append operation. Copy every still-required Loki, S3, Fluentd, or additional Elasticsearch output into the replacement before applying it. Adjust release names and queue limits for the environment; direct chart users must supply the Secret references and mounts separately. Do not turn TLS verification off to match an alternate transport path. Hourly indexes increase index/shard counts: review backend capacity, lifecycle/retention policies, and representative container and host records after the change.