Hi, we have moved to elastic from our on prem 6.2 version elk cluster. We are currently having some problems into decoding json docker logs and renaming indices. My filebeat.yml test file is as follows:
- add_docker_metadata: ~
before we were going though logstash and renaming the indices were quite easy and flexible. Had to include json.ignore_decoding_error: true to cut off those decoding error messages. Can someone please advise?