Change data stream name in filebeat 8.*

Elastic Stack Beats
, ,
6

Here is a filebeat example that creates and writes to datastream filebeat-8.x.x-elastic-internal, index names are like .ds-filebeat-8.1.2-elastic-internal-2022.04.04-000001

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 0

setup.template.name: "filebeat-%{[beat.version]}-elastic-internal"
setup.template.pattern: "filebeat-%{[beat.version]}-elastic-internal*"

setup.ilm.enabled: true
setup.ilm.rollover_alias: "filebeat-%{[agent.version]}-elastic-internal"
setup.ilm.policy_name: "roll_daily_delete_30"


setup.kibana:
  host: "https://...:5601"
 
output.elasticsearch:
  hosts: ["https://...:9200"]
  index: "filebeat-%{[agent.version]}-elastic-internal"
  username: "..."
  password: "..."
  ssl.certificate_authorities: ["/etc/filebeat/..."]
  ssl.certificate: "/etc/filebeat/..."
  ssl.key: "/etc/filebeat/..."

processors:
  - add_host_metadata: ~
  - add_locale: ~

logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644


monitoring.enabled: false
monitoring.cluster_uuid: ...

http.enabled: true

monitoring.elasticsearch:

setup.kibana.ssl.enabled: true
setup.kibana.ssl.certificate_authorities: ["/etc/filebeat/..."]
setup.kibana.ssl.certificate: "/etc/filebeat/..."
setup.kibana.ssl.key: "/etc/filebeat/..."
1 Like