Dynamic filebeat index naming

Elastic Stack Beats
,
1

Hi - I am using the new(er) Okta and PANW filebeat modules.

How do i say "send the okta logs to the okta index and the panw logs to the panw index"

I have tried this to create an index based of the fields.event.module field.

output.elasticsearch:
 index: "%{[fields.event.module]:other}-%{[agent.version]}-%{+yyyy.MM.dd}"

setup.template.name: "index-%{[beat.version]}"
setup.template.pattern: "index-%{[beat.version]}-*"
2

I'm not quite sure if I understand your problem. Did you run filebeat setup?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.