Elastic agent custom configuration to index in multiple indices

Elastic Stack Elasticsearch
1

Hi All,

I am trying to index data into different indices in kubernetes integration, based on the container logs,

output.elasticsearch:
  indices:
    - index: "test-analytics-%{+yyyy.MM}"
      when.contains:
        kubernetes.container.name: "keyahead-api"
    - index: "test-llm-api-logs-%{[kubernetes.container.name]}-%{+yyyy.MM}"
      when.equals:
        kubernetes.container.name: "llminsights-api"

by adding the above settings in the custom configuration in Kubernetes integration similar to the filebeat settings on elastic-agent policy but its not creating a different indices as expected. So please help me to solve this how I can index into different indices on elastic agent configuration.

image
image598×548 28.9 KB

With Regards,
Abhishek M

2

Hello,

Yeah, this does not work for Fleet Managed agents, you cannot change the output this way.

The output will always follow the data stream naming scheme for the integrations.

You cannot have custom index names when using Fleet Managed agents.

Maybe you can do that if you use Standalone agents where you need to manage everything locally.