Custom index name for Filebeat System module output

Elastic Stack Beats
1

Hello,

I'm new to using modules with filebeat, but I'm interested in using the System module to write out syslogs from my Centos7 servers to ES. It looks like by default it will just write to the standard filebeat-* index name, but I was hoping to customize that in order to differentiate between potentially different modules writing to the same index.

I thought I could do something like this, but it doesn't seem to be working... any ideas? Also, would this screw up the built-in module templates and Kibana dashboards? Would I need additional custom configurations to have those point to the write place?

output.elasticsearch:
  hosts: ["logs:9200"]
  indices:
    - index: "filebeat-syslog-%{[beat_version]}-%{+yyyy.MM.dd}"
      when.equals:
        fileset.module: "system"

Thanks in advance for any assistance!

2

@thethomp,

Yes..you are correct that Filebeat dashboards are tied with filebeat-* index. You can't use the filebeat dashboards if you are using any other index.

Thanks.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.