I want to create filebeat index based on event.module and event.dataset, i am using elasticsearch as output.
I have tried the following:
But still i am getting the index in default format.
Where are you setting the
index setting? It should be under the elasticsearch output section.
Hi @legoguy1000 ,
index was set in elasticsearch output only, turns out I had to forcefully set ilm to false after that it started working.
Can I still use ILM for such indices?
If u want to use ILM, u won't use the index setting, you'll use the ILM settings to configure the rollover alias
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.