Creating index name from field value

Elastic Stack Beats
1

Good day,
this is my filebeat.yml file:

filebeat.config:
    modules:
        path: ${path.config}/modules.d/*.yml
        reload.enabled: false

processors:
    - add_cloud_metadata: ~
    - add_docker_metadata: ~
    - add_kubernetes_metadata: ~

output.elasticsearch:
    hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
    username: '${ELASTICSEARCH_USERNAME:}'
    password: '${ELASTICSEARCH_PASSWORD:}'

setup.kibana:
    host: '${KIBANA_HOST}'
    ssl.enabled: false

filebeat.modules:
    - module: kibana
    - module: elasticsearch

fields_under_root: true
json.keys_under_root: true

filebeat.inputs:
    - type: log
      enabled: true
      fields:
          my_type: 'inventory'
      index: 'test-%{[fields.my_type]}-%{+yyyy.MM.dd}'
      paths:
          - /var/log/kibana/kibana.log

setup.ilm.overwrite: true
setup.ilm.enabled: false
setup.template.name: 'test-%{[fields.my_type]}-%{+yyyy.MM.dd}'
setup.template.pattern: 'test-%{[fields.my_type]}-*'

I want create index where my fields are present ( specifically log file name )
It works when I try to do it with agent fields like {[agent.version]}, but got error when I am trying to make name from my custom field or other ones like {[file.name]}
This is the error from filebeat log:
ERROR [publisher] pipeline/client.go:106 Failed to publish event: key not found
Thanks for any hints

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.