Hi All ,
in my previous environment logs generated had a field called "process name" whose value could possibily contain special chars and upper case letters , hence using logstash we downcased it and removed the special characters too. so when logstash created index in elastic server out of the newly modified "process name" there was no issue .
in my new environment file beats is directly sending logs to elastic search . hence file beats has to create the index , but am not sure how file beat can down case and remove the special characters. for this purpose alone we need to install log stash or change the artifact so that the "process name" fields contains any value is qualified enough to create an elastic index. both the ways are tedious.
so any idea how downcasing can by done by filebeat and also the specl char removing.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.