I need to setup a Linux system running Apache to send logs into Elastic Search via Filebeat, but have the Apache module send to a different index. This custom index name needs to use the Filebeat/apache module mappings, pipelines, and dashboards. It will also need a custom Index Life Cycle as the Apache logs will have a different retention time.
I'm trying to figure out how to correctly do this. I've tagged events coming from the module with the apache_log tag, and I found this helpful article:
but I can't use indices when using ILM. I'm not sure how to customize the index name for Apache, specify the ILM i defined within elastic search for Apache, and still send everything else into FileBeat's default. At what point in the configuration and how should this be defined?
Also, from playing around thus far, I'm wondering how much manual work is needed to keep this going. Do I need to manually duplicate the template and modify the index pattern and ILM to do this? And each time I apply each update? Or can this be set in Filebeat and Filebeat does it for you on 'filebeat setup' and filebeat updates? Thank you for your help.