Filebeat Apache Module Change Index Name

Elastic Stack Beats
2

Hi @Ryne_Keel,

If you want to use different indexes for different modules you can use the indices output setting. It allows you to configure different indices depending on some condition, for example you could do something like this in your case to have a different index for apache module:

output.elasticsearch:
  hosts: ["elastic1:9200", "elastic2:9200"]
  indices:
    - index: "filebeat-%{[agent.version]}-apache-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "apache"
    - default: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"

Notice that here I try to keep the default prefixes, this way the defailt patterns for the index mappings (filebeat-%{[agent.version]}-*) and the dashboard (filebeat-*) should work and you wouldn't need to modify these setup settings.

2 Likes