Do we need to create new index for file beat?


#1

I'm using filebeat to ship logs from windows machine to Elasticsearch, with default filebeats setting.
When i try to ship logs using filebeat from other server, i couldnt see any logs on elasticsearch.

In the earlier filebeat shipping the index formed is filebeat, i want to change the name of the index jenkins logs to it if it works, i tried using editing filebeat.yml.

Does elasticsearch listen to multiple filebeat from different servers??


(Steffen Siering) #2

Have you checked filebeat logs about output errors? filebeat normally creates index filebeat-<event timestamp>. If clock is not in sync (check $ date output), events might end up in an old index.


(system) #3