Filbeat.yml file configuration to send to the cloud to different indexes

Hi so I have the following yaml file for filebeat, sending logs file from an on prem server to the elastic cloud. I wanted to have the config to send each log path to the defined indexes, but its not working. Anyone knows if I can use conditionals with the ilm rollover alias ?

here is the yaml file:


  • type: log

    enabled: true


    • L:\iis\web01*
    • L:\agsLogs\registration*

path: ${path.config}/modules.d/*.yml

reload.enabled: false "Test_Centralized_Logging:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
cloud.auth: "elastic:yyyyyyyyyyyyyyyyyyy"
pipeline: geoip-info

setup.ilm.enabled: true
setup.ilm.rollover_alias: "web01"

setup.ilm.enabled: true
setup.ilm.rollover_alias: "registration"


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.