Custom indexes didn't create using winlogbeat-7.2.1 version

hi, custom indexes didn't creating using winlogbeat-7.2.1 version.

Below my winlogbeat configuration that properly works in winlogbeat 6.8.1.

###################### wlb Configuration ##########################

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
    level: critical, error, warning
  - name: System
    ignore_older: 72h
    level: critical, error, warning
  - name: DFS Replication 
    ignore_older: 72h
  - name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
    event_id: 21
    ignore_older: 72h

setup.template:
    name: "custom-sys"
    pattern: "custom-sys-*"
    settings:
     index.number_of_shards: 1
     index.number_of_replicas: 1
     index.codec: best_compression 
 
name: "custom-app"
pattern: "custom-app-*"
settings:
 index.number_of_shards: 1
 index.number_of_replicas: 1
 index.codec: best_compression  
 
name: "custom-sec"
pattern: "custom-sec-*"
settings:
 index.number_of_shards: 1
 index.number_of_replicas: 1
 index.codec: best_compression 

output.elasticsearch:
  # Array of hosts to connect to.
indices:
 - index: "custom-sys-%{+yyyy.MM}"
   when:
     or:
      - equals.log_name: "System"    
      - equals.log_name: "DFS Replication"  
     
 - index: "custom-app-%{+yyyy.MM}"
   when.equals:
     log_name: "Application"  
     
 - index: "custom-sec-%{+yyyy.MM}"
   when.equals:
     log_name: "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
     
hosts: ["myelasticsearch:9200"]

Could you please help me to solve the issue, thanks.

I'm following the documentation:
https://www.elastic.co/guide/en/beats/winlogbeat/current/elasticsearch-output.html

setup.ilm.enabled: false

    winlogbeat.event_logs:
      - name: Application
        ignore_older: 72h
      - name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
        event_id: 21
        ignore_older: 72h

setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 0

output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  indices:
    - index: "wlb-test-app-%{+yyyy.MM}"
      when.equals:
        log_name: "Application" 
    - index: "wlb-test-sec-%{+yyyy.MM}"
      when.equals:
        log_name: "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"

But indexes created with defaults names:

image

If I specify index: before indices: I will send all logs into one Index.
same issue:

any help?

Remember that indention matters so try to indenting all settings under your setup.template properly like:

setup.template:
    name: "custom-sys"
    pattern: "custom-sys-*"
    settings:
        index.number_of_shards: 1
        index.number_of_replicas: 1
        index.codec: best_compression 
 
     name: "custom-app"
     pattern: "custom-app-*"
     settings:
        index.number_of_shards: 1
        index.number_of_replicas: 1
        index.codec: best_compression  
 
     name: "custom-sec"
     pattern: "custom-sec-*"
     settings:
       index.number_of_shards: 1
       index.number_of_replicas: 1
       index.codec: best_compression 

or use full qualifying name ala:

setup.template.name: "custom-sys"
setup.template.pattern: "custom-sys-*"
setup.template.settings.index.number_of_shards: 1
setup.template.settingsindex.number_of_replicas: 1
setup.template.settings.index.codec: best_compression 
 
setup.template.name: "custom-app"
setup.template.pattern: "custom-app-*"
setup.template.settings.index.number_of_shards: 1
setup.template.settings.index.number_of_replicas: 1
setup.template.settings.index.codec: best_compression  
 
setup.template.name: "custom-sec"
setup.template.pattern: "custom-sec-*"
setup.template.settings.index.number_of_shards: 1
setup.template.settings.index.number_of_replicas: 1
setup.template.settings.index.codec: best_compression

No, it's not working. The latest elasticsearch version that separate by indexes is 6.8.1

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.