Apply Ingest Pipeline to all future filebeat-* indices

Elastic Stack Elasticsearch
1

I am using Filebeat to monitor and upload log files to Elasticsearch. Filebeat is configured to upload the logs to filebeat-{date} so each day, the index changes. Is there a way to configure an ingest pipeline so that it gets applied to all future indices of type filebeat-*? Based on what I've seen in the docs, it appears that ingest pipelines can only be applied to existing indices but I'm hoping that's not the case.

I know I can apply the grok filtering using a filter in Logstash but I'm trying to eliminate that dependency with the new ingest pipeline feature.

Thanks!
Brandon

2

I think https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#_pipeline_2 is what you want.

3

Awesome, thanks! I didn't know you could apply the pipelines in the Filebeat config.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.