Filbeat.yml file configuration to send to the cloud to different indexes

Elastic Stack Beats
1

Hi so I have the following yaml file for filebeat, sending logs file from an on prem server to the elastic cloud. I wanted to have the config to send each log path to the defined indexes, but its not working. Anyone knows if I can use conditionals with the ilm rollover alias ?

here is the yaml file:

filebeat.inputs:

  • type: log

    enabled: true

    paths:

    • L:\iis\web01*
    • L:\agsLogs\registration*

filebeat.config.modules:
path: ${path.config}/modules.d/*.yml

reload.enabled: false

cloud.id: "Test_Centralized_Logging:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
cloud.auth: "elastic:yyyyyyyyyyyyyyyyyyy"
pipeline: geoip-info

setup.ilm.enabled: true
setup.ilm.rollover_alias: "web01"

setup.ilm.enabled: true
setup.ilm.rollover_alias: "registration"

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.