# Custom index name for Filebeat System module output

**URL:** <https://discuss.elastic.co/t/custom-index-name-for-filebeat-system-module-output/161892>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 21, 2018, 7:10pm UTC](https://discuss.elastic.co/t/custom-index-name-for-filebeat-system-module-output/161892 "2018-12-21T19:10:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![thethomp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thethomp/32/39343_2.png) [@thethomp](https://discuss.elastic.co/u/thethomp)\
**Post date:** [December 21, 2018, 7:10pm UTC](https://discuss.elastic.co/t/custom-index-name-for-filebeat-system-module-output/161892/1 "2018-12-21T19:10:29Z")

</div>

Hello,

I'm new to using modules with filebeat, but I'm interested in using the System module to write out syslogs from my Centos7 servers to ES. It looks like by default it will just write to the standard filebeat-\* index name, but I was hoping to customize that in order to differentiate between potentially different modules writing to the same index.

I thought I could do something like this, but it doesn't seem to be working... any ideas? Also, would this screw up the built-in module templates and Kibana dashboards? Would I need additional custom configurations to have those point to the write place?

```
output.elasticsearch:
  hosts: ["logs:9200"]
  indices:
    - index: "filebeat-syslog-%{[beat_version]}-%{+yyyy.MM.dd}"
      when.equals:
        fileset.module: "system"

```

Thanks in advance for any assistance!

---

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [January 3, 2019, 11:57am UTC](https://discuss.elastic.co/t/custom-index-name-for-filebeat-system-module-output/161892/2 "2019-01-03T11:57:06Z")

</div>

@thethomp,

> [@thethomp](#):
>
> It looks like by default it will just write to the standard filebeat-\* index name

Yes..you are correct that Filebeat dashboards are tied with `filebeat-*` index. You can't use the filebeat dashboards if you are using any other index.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2019, 11:57am UTC](https://discuss.elastic.co/t/custom-index-name-for-filebeat-system-module-output/161892/3 "2019-01-31T11:57:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.