Custom Index error

Elastic Stack Beats
1

Hello,
I am currently using Elastic Search and Kibana versions 8.11 along with Filebeat 8.11.2 on windows system.
I have been able to send data to elastic through filebeat with the default filebeat* index. I wanted my filebeat data to be stored into different indices for easier access and rule creation.
I've followed the steps in Configure Elasticsearch index template loading | Filebeat Reference [8.11] | Elastic to generate custom index but am failing to do so. I have added

filebeat.inputs:
setup.ilm.enabled: false
setup.template.name: "mycustomindex"
setup.template.pattern: "mycustomindex-*"

output.elasticsearch:
index: "mycustomindex"

But this seems to throw an error, and fails to run Start-Service Filebeat on power shell.
Will be grateful for any input! Thank you!

2

Hi @uhxqc, Could you please share the Error ?? You can check troubleshoot steps.

3

Thank you @ashishtiwari1993, I will check the Troubleshoot, but is my details in the Filebeat.yml file correct, or any other changes have to be made to add a custom index from Filebeat?

4

Looks good. Same you can test with the below command:

./filebeat test config
5

Hello @ashishtiwari1993, seems like I had an issue with indentation and changing that resolved the issue, thank you for the config command!
Just had a question, when I run

Start-Service filebeat
Get-Service filebeat
Status   Name               DisplayName
------   ----               -----------
Running  filebeat           filebeat

But immediately after just a few seconds when I run

Get-Service filebeat
Status   Name               DisplayName
------   ----               -----------
Stopped  filebeat           filebeat

Filebeat seems to automatically stop after a few seconds.
Moreover I am not able to find any of the logs I am trying to upload using Filebeat.

Is there a solution to this?