Create a custom index in winlogbeat using cloud.id

Hello,

I have reviewed a post that contains information on how to accomplish changing the default winlogbeat index name, but it does not seem to work for me.

I have tried exactly what the post provided and it didn't work, so I tried the below:
setup.template.name: 'winlogbeat-%{[beat.version]}-%{+yyyy.MM}_custid'
setup.template.pattern: 'winlogbeat%{[beat.version]}-*'

cloud.id: "XXX:XXXXXX"
cloud.auth: "XXXX:XXXX"
cloud.index: 'winlogbeat-%{[beat.version]}-%{+yyyy.MM}_custid'

Nothing seems to work. Any help would be greatly appreciated.

Hi Tim, what version of Winlogbeat are you using? And what version of Elasticsearch? And this is on Elastic Cloud?

In 7.0 beat.version was replaced with agent.version. Additionally there's a new index lifecycle management feature that could be in play depending on versions that automatically creates new indexes based on criteria like size or time period

winlogbeat version 6.6.0 (amd64), libbeat 6.6.0 [2c385a0764bdc537b6dc078a1d9bf11bb6d7bd95 built 2019-01-24 10:45:45 +0000 UTC]

We are on elastic cloud and running 6.7.0

Thanks Andrew

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.