Custom filebeat index

[Bryce_Fernandes]

Hi,

I want to create filebeat index based on event.module and event.dataset, i am using elasticsearch as output.

I have tried the following:

setup.template.name: "filebeat"
setup.template.pattern: "filebeat-*"

index: "filebeat-%{[event.module]}-%{[event.dataset]}-%{+yyyy.MM.dd}"

But still i am getting the index in default format.
filebeat-7.11.1-2021-05-20

Thanks,
Bryce Fernandes.

[legoguy1000 (Alex)]

Where are you setting the index setting? It should be under the elasticsearch output section.

[Bryce_Fernandes]

Hi @legoguy1000 ,

index was set in elasticsearch output only, turns out I had to forcefully set ilm to false after that it started working.

Can I still use ILM for such indices?

Thanks,
Bryce Fernandes

[legoguy1000 (Alex)]

If u want to use ILM, u won't use the index setting, you'll use the ILM settings to configure the rollover alias