Create a custom index in winlogbeat using cloud.id

Elastic Stack Beats
1

Hello,

I have reviewed a post that contains information on how to accomplish changing the default winlogbeat index name, but it does not seem to work for me.

I have tried exactly what the post provided and it didn't work, so I tried the below:
setup.template.name: 'winlogbeat-%{[beat.version]}-%{+yyyy.MM}_custid'
setup.template.pattern: 'winlogbeat%{[beat.version]}-*'

cloud.id: "XXX:XXXXXX"
cloud.auth: "XXXX:XXXX"
cloud.index: 'winlogbeat-%{[beat.version]}-%{+yyyy.MM}_custid'

Nothing seems to work. Any help would be greatly appreciated.

2

Hi Tim, what version of Winlogbeat are you using? And what version of Elasticsearch? And this is on Elastic Cloud?

In 7.0 beat.version was replaced with agent.version. Additionally there's a new index lifecycle management feature that could be in play depending on versions that automatically creates new indexes based on criteria like size or time period

3

winlogbeat version 6.6.0 (amd64), libbeat 6.6.0 [2c385a0764bdc537b6dc078a1d9bf11bb6d7bd95 built 2019-01-24 10:45:45 +0000 UTC]

We are on elastic cloud and running 6.7.0

Thanks Andrew