Custom filebeat index

Elastic Stack Beats
1

Hi,

I want to create filebeat index based on event.module and event.dataset, i am using elasticsearch as output.

I have tried the following:

setup.template.name: "filebeat"
setup.template.pattern: "filebeat-*"

index: "filebeat-%{[event.module]}-%{[event.dataset]}-%{+yyyy.MM.dd}"

But still i am getting the index in default format.
filebeat-7.11.1-2021-05-20

Thanks,
Bryce Fernandes.

2

Where are you setting the index setting? It should be under the elasticsearch output section.

3

Hi @legoguy1000 ,

index was set in elasticsearch output only, turns out I had to forcefully set ilm to false after that it started working.

Can I still use ILM for such indices?

Thanks,
Bryce Fernandes

4

If u want to use ILM, u won't use the index setting, you'll use the ILM settings to configure the rollover alias

2 Likes
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.