Can we use datastreams with Filebeat?659+

Elastic Stack Beats
1

Hello,

So "Can we use datastreams with Filebeat?" And more importantly, can we mix multiple inputs, where some use legacy ilm and some use datastreams? This is in a test 7.10.1 setup without Logstash.

For example untill now I had these 2 log inputs:

filebeat.inputs:
- type: log
  paths: C:\Windows\System32\LogFiles\Firewall\*.log
  pipeline: filebeat-windows-firewall
  fields_under_root: true
  fields.service.name: "Windows Firewall"
  
- type: syslog
  protocol.udp:
    max_message_size: 25KiB
    host: "192.168.1.102:10514"
  pipeline: filebeat-pfsense

I'd love to migrate my pfsense to a datastream, and leave the Windows Firewall logs as they are.

logs-netgate.pfsense-default should be the name of the datastream. Should I try use a conditional on output.elasticsearch.index? Should I set _index in the new pipeline? Or what is the recommended way to start migrating to datastreams?

Grtz

Willem

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.