Custom Index for Functionbeat

Elastic Stack Beats
1

Hi Team, I am trying to deploy function beat to read AWS logs which i am succesfully able to do.

However, i require different index to be created in Elasticsearch for different log groups.Below id the elasticsearch output condition i used, which isnt working.

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["10.10.10.10:9200"]
  indices:
    - index: "xyz"
      when.contains:
      log_group: "ec2"

I also tried providing the full log groups name under the log_group.
Elastic search version : 7.7.1
Functionbeat version : 7.9.0
Please help me to understand and resolve the issue.

2

Team, Is there anything i can try? I'd really appreciate any guidance. Thanks!

3

Here is a similar thread: Handling multiples modules output to multiples indexes, good practice?

4

Able to create new index by using below configuration on top of output.elasticsearch in functionbeat.yml

setup.ilm.enabled: false
setup.template.name: "xyz"
setup.template.pattern: "xyz-*"
output.elasticsearch:

5

Egsyefsi 5wvuxtsy7wfehd7sfshfsydgxhs6svcbysicjdhufushdufhshfsfshd8chfgdjxydhjehdfeu

Fyzvdusgfyzhdns7r
Sfhd5sgddgdydyýd
Dyehdhdudud dudduat