# Filebeat - Datastreams?

**URL:** <https://discuss.elastic.co/t/filebeat-datastreams/287442>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 22, 2021, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-datastreams/287442 "2021-10-22T14:00:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![scott\_stash](https://avatars.discourse-cdn.com/v4/letter/s/c89c15/32.png) [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\
**Post date:** [October 22, 2021, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-datastreams/287442/1 "2021-10-22T14:00:51Z")

</div>

Currently we have configured data streams in our environment and its working as expected with Logstash.

For Filebeat do we just use the datastream name as the index value? Or do we create an alias to the datastream and write to that index?

I believe the default Logstash action is to index, not create, not sure if that will cause an issue with Filebeat as well?

---

<div class="post-metadata">

**Author:** ![scott\_stash](https://avatars.discourse-cdn.com/v4/letter/s/c89c15/32.png) [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\
**Post date:** [October 25, 2021, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-datastreams/287442/2 "2021-10-25T14:08:17Z")

</div>

To get this to work I had to do the following, add a processor in filebeat.yml:

```auto
    - script:
        lang: javascript
        source: >
          function process(event) {
              event.Put("@metadata.op_type", "create");
          }

```

Also in my filebeat.yml the following parameters needed to be set:

```auto
setup.ilm.enabled: false 
setup.template.enabled: false
setup.template.name: "weaponx"
setup.template.pattern: "logs-weaponx-*"

output.elasticsearch.index: "logs-weaponx-filebeat"

```

Note all my index and index templates already existed inside ES.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2021, 4:09pm UTC](https://discuss.elastic.co/t/filebeat-datastreams/287442/3 "2021-11-22T16:09:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.