Dynamic Index Names via Filebeat

[dfir (Anthony)]

Closing this out.

I used this as a base guide for some adjustments to the Config:

Creating dynamic index name with Filebeat based on custom event field fails

I got this working after getting a better understanding of the concept of fields in filebeat and elasticsearch. In my case, the custom field I was referring to is created in the elasticsearch ingest pipeline. Those fields are not yet created/available to filebeat. What I did was use a primitive dissect processor within filebeat.yml to process the log message and extract the field I was interested in. That field is now available to be referenced in the filebeat.yml file. I then used that fie…