Hello,
I cannot mutate a message and add a field if the index is created from a template, having a lifecycle policy.
The pipeline that I am using is:
input {
beats {
client_inactivity_timeout => 3000
port => 5044
ssl => false
type => "beats"
}
}
## Add your filters / logstash plugins configuration here
filter {
mutate {
add_tag => ["INFO"]
add_field => {"log.message.type" => "INFO"}
}
}
output {
if [type] == "beats"{
elasticsearch {
hosts => "localhost:9200"
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
}
The filebeat index, index template, and lifecycle policy are created by uncommenting the following lines in filebeat.yml file:
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]
If I comment out the lines above and remove the template and the lifecycle policy, the fields are added successfully to the message.
Can you help me to understand what could be the reason?
Thanks!