Filebeat 6.2.2 - Index Template

Elastic Stack Beats
1

Hi -

Is it possible to create my own index template file as a replacement for the default template which is fields.yml?
For example: "filebeat_template.yml" and then load it from filebeat.yml like this:

setup.template.enabled: true
setup.template.name: "filebeat_template"
setup.template.fields: "filebeat_template.yml"
setup.template.pattern: "filebeat_template*"

Any help? Thanks in advance.

2

Hi @_kyllr,

Yes its possible to overwrite the template in filebeat.

Please refer below link for the same.

https://www.elastic.co/guide/en/beats/filebeat/1.2/filebeat-template.html

Regards,

3

Thanks @harshbajaj16

And do you know how to set datatypes in that "filebeat_template.yml" file the fields that I'll be using as:
type: "text" and subtype: "keyword"

4

Is this even possible?

- name: AuthenticationMethod
  type: text
  type: keyword
  description: >
    Contains user AuthenticationMethod
5

Hi @_kyllr,

I'm not sure about this configuration. Please check below thread for the same.

It may be helpful and if you are still getting issue to set datatypes then please let me know.

Regards,

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.