Beats and index naming

[stephenb (Stephen Brown)]

This thread may be of help as well

Elasticsearch custom ILM

Hello, I am attempting to setup custom indexes for winlogbeat via logstash using ILM settings in the elasticsearch output. I would like to use the default template for winlogbeat (winlogbeat-7.3.0) but have different custom indexes for each organization. The purpose of the separate indexes is to have users be able to login to the kibana instance with roles that can only view their particular indexes for winlogbeat. I would like to use the following base structure for the indexes winlogbeat-…