Custom filebeat index


I want to create filebeat index based on event.module and event.dataset, i am using elasticsearch as output.

I have tried the following: "filebeat"
setup.template.pattern: "filebeat-*"

index: "filebeat-%{[event.module]}-%{[event.dataset]}-%{+yyyy.MM.dd}"

But still i am getting the index in default format.

Bryce Fernandes.

Where are you setting the index setting? It should be under the elasticsearch output section.

Hi @legoguy1000 ,

index was set in elasticsearch output only, turns out I had to forcefully set ilm to false after that it started working.

Can I still use ILM for such indices?

Bryce Fernandes

If u want to use ILM, u won't use the index setting, you'll use the ILM settings to configure the rollover alias


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.