ELK version 8.6.2 - custom data-stream and index name


Since i updated to this new version, i can´t configure a custom name to my index and data-stream.

By default, filebeat creates a Data Stream named "filebeat-8.6.2" and a index ".ds-filebeat-8.6.2-2023.03.23-000001".

What i want to do is to define a custom name instead of "filebeat" e.g "customname-8.6.2" and ".ds-customname-8.6.2-2023.03.23-000001". In addition to that, i need this to be rolled over every day.

Before the update, my config was this:

setup.ilm.enabled: auto
setup.ilm.rollover_alias: "suricata-ids" #Write your alias
setup.ilm.pattern: "{now/d}-000001"
setup.template.name: "suricata-ids"
setup.template.pattern: "suricata-ids-*"

Now this config is not working but i want to configure something similar to this.


Read this closely ... This is metricbeat should be same for filebeat.

Spot on! It worked, thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.