# Custom configuration for new Beat

**URL:** <https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470>\
**Category:** Beats\
**Tags:** beats-development\
**Created:** [December 19, 2017, 3:56pm UTC](https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470 "2017-12-19T15:56:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Albers](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@Michael\_Albers](https://discuss.elastic.co/u/Michael_Albers)\
**Post date:** [December 19, 2017, 3:56pm UTC](https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470/1 "2017-12-19T15:56:28Z")

</div>

I'm creating a new Beat from the Developer Guide ([https://www.elastic.co/guide/en/beats/devguide/master/index.html](https://www.elastic.co/guide/en/beats/devguide/master/index.html)). The Beat is functioning well, but I would like to do some final configuration. I've looked all over and have found nothing about how to do this. I'm mainly interested in how to change the index name template the Beat is using and how to have the Beat supply information for Elasticsearch to create an index alias for the indexes the Beat will be writing to.

The Beat is always creating indexes named \<beatname\>-7.0.0-alpha1-yyyy.MM.dd and there is no alias. What do I need to do to override the index name template and create an alias? Thanks.

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [December 19, 2017, 8:54pm UTC](https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470/2 "2017-12-19T20:54:33Z")

</div>

Hello @Michael_Albers,

You will want to override the elasticsearch **index** option and I believe you will need to use the cfg low level api to do that.

```auto
cfg.SetString("output.elasticsearch.index", "myindex")

```

You might want to check for it before to make sure you don't override the user setting.

```auto
cfg.String("output.elasticsearch.index")

```

We use a similar flow to support Elastic's cloud `cloud.id` you might [want to check it out](https://github.com/elastic/beats/blob/master/libbeat/cloudid/cloudid.go).

Concerning creating an alias over multiple indices we never have a need for that in any of our beats, we usually query over wilcards defined indices like `filebeat-*` which gives a similar feel on the UI on an alias on multiple indices.

I am curious of your use case here?

Thanks.

---

<div class="post-metadata">

**Author:** ![Michael\_Albers](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@Michael\_Albers](https://discuss.elastic.co/u/Michael_Albers)\
**Post date:** [December 19, 2017, 9:27pm UTC](https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470/3 "2017-12-19T21:27:45Z")

</div>

@pierhugues,

Thanks for the quick response. I added the following snippet to my `New` function, after the `cfg.Unpack` call:

`cfg.SetString("output.elasticsearch.index", -1, "test_index")`

(`SetString` wanted an integer as the second parameter and other places which called that function used -1.)

`SetString` returned no error, however, the default index naming scheme was used.

The use case is pretty simple. The Beat is going to be doing its thing and another service I'm running will then query Elastic to get an average or percentile of the data produced by the Beat. The service will then base some request parameters on the average/percentile. The data generated by the Beat will be retained for a substantial amount of time, probably 1 year, so there will be many indexes.

I can probably live without the alias. I'd like to change the index names to closer match some other index naming conventions that are used. It would also be nice to have a version number in the index name that I can control.

---

<div class="post-metadata">

**Author:** ![Michael\_Albers](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@Michael\_Albers](https://discuss.elastic.co/u/Michael_Albers)\
**Post date:** [December 19, 2017, 10:46pm UTC](https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470/4 "2017-12-19T22:46:51Z")

</div>

@pierhugues

I've been playing around with the index settings further and here's what I've found.

I added the following to \_meta/beat.yml  
`
output.elasticsearch:
  index: test_index
`  
And the corresponding `setup.template` keys to \_meta/beat.yml and ran `make update`. This changed the name of the template being used. However, the indexes still used the default naming. In playing around with the generated config file further, I found that the use of the `output.elasticsearch` key in the \_meta/config.yml in libbeat (see lines 60-62 at [https://github.com/elastic/beats/blob/master/libbeat/\_meta/config.yml](https://github.com/elastic/beats/blob/master/libbeat/_meta/config.yml)) is essentially erasing the value I had set for `index`.

When I manually merged the two `output.elasticsearch` entries into  
`
output.elasticsearch:
  index: test_index
  hosts: ["localhost:9200"]
`  
I was able to get the index names I specified.

That begs the larger question, is this a bug in the libbeat YAML parsing? If not, how is one supposed to override any of these pre-defined values through the prescribed `make setup; make` procedure for building a custom Beat?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2018, 10:47pm UTC](https://discuss.elastic.co/t/custom-configuration-for-new-beat/112470/5 "2018-01-16T22:47:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
