Define an index for weblogs being sent from Filebeat > Logstash > Elasticsearch


(Brad) #1

How and where do I define an index for the weblogs being sent from Filebeat. Currently they are arriving as logstash-[thedate] which is not ideal.


#2

In the logstash configuration, the default index used by an elasticsearch output is "logstash-%{+YYYY.MM.dd}". You are free to change that.


(Brad) #3

Thanks for the help. Should I update my outputs with:

ilm_enabled => true
index: "weblogs"

Or do I need to define other things?

My outputs is:

echo “” > first-pipeline.conf

vim first-pipeline.conf

input {

beats {

port => "5044"

}

}

filter {

grok {

match => { "message" => "%{COMBINEDAPACHELOG}"}

}

geoip {

source => "clientip"

}

}

output {

elasticsearch {

hosts => [ "localhost:9200" ]

}

}


(Brad) #4

You can disregard. I did some tweaking and it is now working with:

index => web_logs