Change the default index pattern of winlogbeat?

Elastic Stack Beats
1

Hi, I am trying to change the default pattern for the indexes generated by winlogbeat.
I have followed the indications of the official documentation, but at some point I have missed something ...

winlogbeat.yml:

#==================== Elasticsearch template setting ==========================

setup.template.settings:
setup.template.name: "coliflower"
setup.template.pattern: "coliflower-*"
...
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:

Array of hosts to connect to.

enabled: true
hosts: ["myip:9200"]
index: "coliflower-%{+yyyy.MM.dd}"

winlogbeat\kibana\default\index-pattern\winlogbeat.json (I change winlogbeat-* for that):

...
"timeFieldName": "@timestamp",
"title": "coliflower-"
},
"id": "coliflower-",
"type": "index-pattern",
"version": 1
}
],
"version": "6.1.0"
}

winlogbeat\kibana\5.x\index-pattern (I change winlogbeat-* for that):

...
"timeFieldName": "@timestamp",
"title": "coliflower-*"
}

Results log:

CRIT Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified.

If I put the following in the elasticsearch output (winlogbeat.yml):

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:

Array of hosts to connect to.

enabled: true
hosts: ["myip:9200"]
output.elasticsearch.index: "coliflower-%{+yyyy.MM.dd}"

It starts but the indexes in elastic are:

yellow open winlogbeat-6.1.1-2018.06 ...
yellow open winlogbeat-6.1.1-2018.06 ...
yellow open winlogbeat-6.1.1-2018.06 ...

Someone knows what I'm doing wrong, the only thing I want is to change the name...

2

Firstly, please do not post screenshots of text. Just paste the raw text and surround it with three back-ticks to retain formatting.

Here's an example for changing the index name to use ISO weekly index naming. Adjust accordingly based on your naming requirements. But basically you need to set three settings when customizing the index naming (setup.template.name, setup.template.pattern, and output.elasticsearch.index).

setup.template:
  name:    'winlogbeat-%{[beat.version]}'
  pattern: 'winlogbeat-%{[beat.version]}-*'

output.elasticsearch:
  hosts: ['http://localhost:9200']
  index: 'winlogbeat-%{[beat.version]}-%{+xxxx.ww}'
1 Like
3

This has worked perfect for me.
Thanks Andrew

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.