Can we use datastreams with Filebeat?659+

Hello,

So "Can we use datastreams with Filebeat?" And more importantly, can we mix multiple inputs, where some use legacy ilm and some use datastreams? This is in a test 7.10.1 setup without Logstash.

For example untill now I had these 2 log inputs:

filebeat.inputs:
- type: log
  paths: C:\Windows\System32\LogFiles\Firewall\*.log
  pipeline: filebeat-windows-firewall
  fields_under_root: true
  fields.service.name: "Windows Firewall"
  
- type: syslog
  protocol.udp:
    max_message_size: 25KiB
    host: "192.168.1.102:10514"
  pipeline: filebeat-pfsense

I'd love to migrate my pfsense to a datastream, and leave the Windows Firewall logs as they are.

logs-netgate.pfsense-default should be the name of the datastream. Should I try use a conditional on output.elasticsearch.index? Should I set _index in the new pipeline? Or what is the recommended way to start migrating to datastreams?

Grtz

Willem

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.