# Filebeat Apache Module Change Index Name

**URL:** <https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 15, 2019, 6:42pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955 "2019-04-15T18:42:44Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryne\_Keel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryne_keel/32/42827_2.png) [@Ryne\_Keel](https://discuss.elastic.co/u/Ryne_Keel)\
**Post date:** [April 15, 2019, 6:42pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/1 "2019-04-15T18:42:45Z")

</div>

Been having trouble getting the index to be created as a different index name than filebeat.

```
#============================= Filebeat modules ===============================

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

  reload.enabled: true
  reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.name: "apache"
setup.template.name: "apache-*"
setup.template.fields: "fields.yml"
setup.template.overwrite: false
setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 1

#==================== General ==========================

name: agamemnon
#tags: ["apache", "internal"]

#============================== Dashboards =====================================

setup.dashboards:
  index: "apache-*"

#============================== Kibana =====================================

setup.kibana:
  host: "kibana:5601"

#================================ Outputs =====================================
output.elasticsearch:
  hosts: ["elastic1:9200", "elastic2:9200"]
  index: "apache-%{[agent.version]}-%{+yyyy.MM.dd}"

#----------------------------- Logstash output --------------------------------
#output.logstash:
# hosts: ["logstash2:5044"]

#================================ Processors =====================================

# Configure processors to enhance or manipulate events generated by the beat.

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

#==================== Logging ==========================

logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

```

With the config above, I am able to delete my apache dashboard and visualizations, then have it reimport the dashboards, and the dashboard will look for apache-\* index pattern as expected.

However, I cannot get the index to write as apache-, and it always just uses the filebeat index. I would like to change this as across all of our hosts I will be sending certain things such as apache, nginx, and mysql for starters with filebeat modules. I was able to get the index name to change using logstash, but logstash strips the fields that filebeat sends which are needed to operate the default dashboard, and are also more robust than the logstash combinedaccess log grok filter, so was hoping to for ease send directly from FB to ES.

I assume it hurts performance to have multiple modules / event patterns sent to ES inside the same index?

Any suggestions?

Filebeat7, ES7, LS7, Kibana7

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [April 16, 2019, 8:34am UTC](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/2 "2019-04-16T08:34:55Z")

</div>

Hi @Ryne_Keel,

If you want to use different indexes for different modules you can use the [`indices`](https://www.elastic.co/guide/en/beats/filebeat/7.0/elasticsearch-output.html#indices-option-es) output setting. It allows you to configure different indices depending on some condition, for example you could do something like this in your case to have a different index for apache module:

```auto
output.elasticsearch:
  hosts: ["elastic1:9200", "elastic2:9200"]
  indices:
    - index: "filebeat-%{[agent.version]}-apache-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "apache"
    - default: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

```

Notice that here I try to keep the default prefixes, this way the defailt patterns for the index mappings (`filebeat-%{[agent.version]}-*`) and the dashboard (`filebeat-*`) should work and you wouldn't need to modify these setup settings.

---

<div class="post-metadata">

**Author:** ![Ryne\_Keel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryne_keel/32/42827_2.png) [@Ryne\_Keel](https://discuss.elastic.co/u/Ryne_Keel)\
**Post date:** [April 16, 2019, 3:13pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/3 "2019-04-16T15:13:51Z")

</div>

This works although I can't get the:

```auto
    - default: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

```

working - filebeat won't even start when I have that for some reason, but it works well if I just take that out. Thanks for the advice too on putting apache in the middle of the index name so that I don't have to mess with the default dashboard

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [April 16, 2019, 5:08pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/4 "2019-04-16T17:08:30Z")

</div>

Oh sorry, my bad, the `default` option is for a default mapping, not for a default index.

---

<div class="post-metadata">

**Author:** ![Ryne\_Keel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryne_keel/32/42827_2.png) [@Ryne\_Keel](https://discuss.elastic.co/u/Ryne_Keel)\
**Post date:** [April 16, 2019, 5:22pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/5 "2019-04-16T17:22:16Z")

</div>

No worries, I am just glad this is working now 🙂 Thanks again

---

<div class="post-metadata">

**Author:** ![subhas](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@subhas](https://discuss.elastic.co/u/subhas)\
**Post date:** [May 13, 2019, 9:05am UTC](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/6 "2019-05-13T09:05:21Z")

</div>

Hi @jsoriano ,

Can we use two different indexes within the same apache module? If so how do you configure that? Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 10, 2019, 9:05am UTC](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/7 "2019-06-10T09:05:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.