Auditbeat is configured to send data to Elasticsearch directly. I'm trying to get auditbeat to create a new index every day. Right now this is the index that beats uses: auditbeat-7.9.0-2020.08.24-000001
, even though today is 2020.09.01
.
For that, I've set up these lines in auditbeat.yml
:
output.elasticsearch:
index: "auditbeat-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "auditbeat"
setup.template.pattern: "auditbeat-*"
But when I start auditbeat I get this:
Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified
Does anyone know why I get this? As seen in my .yml
file I have included these fields.
Thanks ahead!