Hi,
I am unable to setup filebeat to send logs to logstash, I followed few solutions of setting up index management using Elasticsearch output then delete old document but the issue is still exist.
I have also disabled automatic index template loading. I don't know what's wrong.
Error: Exiting: Index management requested but the Elasticsearch output is not configured/enabled
filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
- type: filestream
enabled: false
paths:
- /var/log/*.log
# ============================== Filebeat modules ==============================
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
# ------------------------------ Logstash Output -------------------------------
setup.ilm.overwrite: false
setup.template.enabled: false
setup.template.overwrite: false
setup.ilm.enabled: false
ilm.enabled: false
output.logstash:
hosts: ["IP:5044"]
# ================================= Processors =================================
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
I followed this solution: Load the Elasticsearch index template | Filebeat Reference [7.15] | Elastic