Enable 2 different filebeat modules & send to different index name


I am trying to use a single filebeat, enabled with system & apache module to send to elasticsearch. I would want to have a system index and a apache index. How can i do this?
ILM is enabled for me and for a single module, i set my index via this setting:

setup.ilm.enabled: auto
setup.ilm.rollover_alias: "filebeat-linuxclient"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.overwrite: false

now i would like to have filebeat-linuxclient-system and filebeat-linuxclient-apache as the alias.

This is my current filebeat.yml file settings for enabling system module:


  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

  index.number_of_shards: 1

  host: "kibana:5601"

  hosts: ["esnode1:9200", "esnode2:9200", "esnode3:9200"]

  - add_host_metadata: ~
  - add_cloud_metadata: ~

logging.metrics.period: 60

setup.ilm.enabled: auto
setup.ilm.rollover_alias: "filebeat-linuxclient"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.overwrite: false

How can i do this?


Does my comment in this thread help with what you're trying to achieve?

Should I comment out the ILM settings?

I guess I should write these settings in filebeat.yml and

  index: "default-%{+yyyy.MM.dd}"
    - index: "filebeat-system-%{+yyyy.MM.dd}"
        application: "system"
    - index: "filebeat-apache-%{+yyyy.MM.dd}"
        application: "apache"

Do I need to tag application: system and application: apache in their modules config file?

I'm not familiar with ILM so I can't say what you'd want to do with that.

application was just an example of a potential field name you could use to differentiate between the two log sources.

I think given you're using two different modules you can probably use the event.module field or something similar to configure different index outputs.

1 Like

Alright i will give it a try! Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.