Filebeat and Fortinet

Blockquote

Hello.
Filebeat seems to have built in Index patterns and templates for some Fortinet products, which is good from my point of view.
What I would like to do is to instead of using the default index that Filebeat creates, change it to something else that tells you more of what kind of logs we are importing, I thinking mostly about logs from Fortinet firewalls:

index: "fortigate-%{+yyyy.MM.dd}"

According to the documentaion, if I want to use my own Index name, I need to also configure the setup.template.name and setup.template.pattern.
Is there any way for me to use the existing template name and template patterns that is built in to the Filebeat for this task?

Blockquote

Hi,

we have the same setup , we have created the ILM ploicy ,index pattern ,index and alias with name we want and configure filebeat with the setup.template.name and setup.template.pattern.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.