Comand line Filebeat

[franco.federico]

Hi all

I'm using the filebeat command line and I'm searching a mode in order to create a different name of index instead of filebeat-*.

I'm using this command

sudo filebeat -e --module apache2 -M "apache2.access.var.paths=[<path_log_apache>]"

How could I set that I want to create for example the index test_filebeat-* instead of filebeat-*.

In logstash there is the output configuration in which I set the new index name instead of the defaul name logstash.

Could you help me?

Thank you
Franco

[tudor (Tudor Golubenco)]

It's the output.elasticsearch.index setting, but it's a bit more complex for modules because the dashboards and templates all assume a given index name. So you need to change all the settings mentioned here under Change the index name.

You can introduce these settings at the CLI with -E, if you prefer the CLI.

[franco.federico]

Thank you Tudor for the reply. I think that I could export dashboard in a file, then I set the parameter in filebeat.yml.
After I re-import dashboard modified (I open the file and set new index name in the dashboard and visualize too).

At the end I start the filebeat with the modifie parameter.

Do you think that this could be a good solution?

Bye
Franco