So "Can we use datastreams with Filebeat?" And more importantly, can we mix multiple inputs, where some use legacy ilm and some use datastreams? This is in a test 7.10.1 setup without Logstash.
For example untill now I had these 2 log inputs:
filebeat.inputs: - type: log paths: C:\Windows\System32\LogFiles\Firewall\*.log pipeline: filebeat-windows-firewall fields_under_root: true fields.service.name: "Windows Firewall" - type: syslog protocol.udp: max_message_size: 25KiB host: "192.168.1.102:10514" pipeline: filebeat-pfsense
I'd love to migrate my pfsense to a datastream, and leave the Windows Firewall logs as they are.
logs-netgate.pfsense-default should be the name of the datastream. Should I try use a conditional on
output.elasticsearch.index? Should I set _index in the new pipeline? Or what is the recommended way to start migrating to datastreams?