Filebeat 6.2.2 - Index Template

[_kyllr (Eykilles)]

Hi -

Is it possible to create my own index template file as a replacement for the default template which is fields.yml?
For example: "filebeat_template.yml" and then load it from filebeat.yml like this:

setup.template.enabled: true
setup.template.name: "filebeat_template"
setup.template.fields: "filebeat_template.yml"
setup.template.pattern: "filebeat_template*"

Any help? Thanks in advance.

[harshbajaj16 (Harsh Bajaj)]

Hi @_kyllr,

Yes its possible to overwrite the template in filebeat.

Please refer below link for the same.

https://www.elastic.co/guide/en/beats/filebeat/1.2/filebeat-template.html

Regards,

[_kyllr (Eykilles)]

Thanks @harshbajaj16

And do you know how to set datatypes in that "filebeat_template.yml" file the fields that I'll be using as:
type: "text" and subtype: "keyword"

[_kyllr (Eykilles)]

Is this even possible?

- name: AuthenticationMethod
  type: text
  type: keyword
  description: >
    Contains user AuthenticationMethod

[harshbajaj16 (Harsh Bajaj)]

Hi @_kyllr,

I'm not sure about this configuration. Please check below thread for the same.

New template generation logic

It may be helpful and if you are still getting issue to set datatypes then please let me know.

Regards,