Hi,
I'm using filebeat to send logs from Filezilla server to ELK server. It's working, and the default index is filebeat-6.3.0-YYYY.mm.dd
I want to change that because more logs with filebeat will be sent and i don't want to mix differents logs application in one index.
So I have used redindex API to copy all indices in new indices ( filebeat-6.3.0-YYYY.mm.dd to filezilla-logs-YYYY.mm.dd)
When I change the source of a saved searched to have the informations from the new indices, I have a error message :
Could not locate that index-pattern (id: filezilla-logs-*),
But this pattern exisits, I have created this once I have renamed the indices.
I don't undestand what's wrong.
I have also created a new search from the new index and I saved it. When I read it, the index is a serial number : 2a61ec40-e2a2-11e8-a38e-69b7fe5aaa9d
Why it's not the same name as the index pattern ?
Fo winlogbeat or heartbeat, it's not a serial number.
So how I can have the saved searches with the new indices pattern without to recreated them from scratch ?
Thank you for your help.