We are trying to configure Filebeat to send logs to Elasticsearch. We want to create different index than the default one. Here is the configuration
- input_type: log
We found logs in filebeat-6.2.4-2018.04.18 always. How can we send logs to application1-6.2.4-2018.04.18 index of Elasticsearch.
I have the same issue as well, i tried to send the logs using filebeats to logstash and have a grok filter to create the index but not successful.
I read that we can do it by document_type but seems thats is deprecated.
could you please try with below format.
As @harshbajaj16 mentioned it looks like the config option is wrong + the indentation. Here are the docs: https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html
@rufin and @harshbajaj16 I have updated my configuration accordingly but when I restart filebeat, it is giving me the following error message.
2018-04-19T10:22:37.587-0400 ERROR instance/beat.go:667 Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified.
Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified.
Here is my updated configuration
when you set index name Beats force you to also set template and pattern. However, If you don't want to set this just put below line in your config file.
setup.template.enabled: false worked, thanks
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.