Hi @badger,
As shown in above filebeat.yml output, I have both type and log_type defined and due to below config in logstash.conf , type is getting replaced by access_server.
mutate {
replace => {
"[type]" => "access_server"
}
}
and index is getting created as access_server-2021...
index => "%{type}-%{+YYYY.MM.dd}"
You were right, i can see below index was created but still not sure why and why its name is missing. i.e why its not like access_server-2021...
yellow open %{type}-2021.07.08 epj_-5ruQcSrz3uA 1 1 284 0 336.2kb 336.2kb
I see today's (9th July) index is created after running some test data.
yellow open access_server-2021.07.09 bPV6GXW3da7A 1 1 359 0 763.3kb 763.3kb