Define an index for weblogs being sent from Filebeat > Logstash > Elasticsearch

Elastic Stack Logstash
1

How and where do I define an index for the weblogs being sent from Filebeat. Currently they are arriving as logstash-[thedate] which is not ideal.

2

In the logstash configuration, the default index used by an elasticsearch output is "logstash-%{+YYYY.MM.dd}". You are free to change that.

3

Thanks for the help. Should I update my outputs with:

ilm_enabled => true
index: "weblogs"

Or do I need to define other things?

My outputs is:

echo “” > first-pipeline.conf

vim first-pipeline.conf

input {

beats {

port => "5044"

}

}

filter {

grok {

match => { "message" => "%{COMBINEDAPACHELOG}"}

}

geoip {

source => "clientip"

}

}

output {

elasticsearch {

hosts => [ "localhost:9200" ]

}

}

4

You can disregard. I did some tweaking and it is now working with:

index => web_logs

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.