Create two index with winlogbeat 7.3

Elastic Stack Beats
1

Hello,
I'm trying to configure winlogbeat to create 2 index, one for each user.

I Know I can configure this using this command:

setup.template.name: 'new-index'
setup.template.pattern: 'new-index-*'

output.elasticsearch:
hosts: [http://localhost:9200]
indices:
- index: "new-index-user1"
when.contains:
user.name: "user1"
- index: "new-index-user2"
when.contains:
user.name: "user2"

but as I have winlogbeat 7.3, in documentation say: The index setting is ignored when index lifecycle management is enabled.
Starting with version 7.0, Winlogbeat uses index lifecycle management by default when it connects to a cluster that supports lifecycle management. Winlogbeat loads the default policy automatically and applies it to any indices created by Winlogbeat.

then I have configured next command:

setup.ilm.rollover_alias: 'new-index'
setup.ilm.pattern: '{now/d}-01'

but I don't know how to create two index, one for events created by user1 and the other one for events created by user2.

please could someone help me?? I'm stuck in this point, thank you very much.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.