Filebeat, different indices from different CSV

Elastic Stack Beats
1

Hi all,
I need your help to understand where or what is wrong. I need to read different file csv (for now 4 csv) and write the data in 4 indexs on elastic using Filebeat.

This configuration with 2 CSV, 2 indexs and 2 pipeline is ok and it works...i can find the new indexs on elastic.

filebeat.inputs:
	- type: log
	  enabled: true
	  close_eof: true
	  paths:
		- C:\AAAA_*.csv
	  fields:
		A: "si"
		B: "no"
	- type: log
	  enabled: true
	  close_eof: true
	  paths:
		- C:\BBBB_*.csv
	  fields:
		A: "no"
		B: "si"

output.elasticsearch:
  hosts: ["localhost:9200"]

  index: "A-%{+YYYY.MM.dd.HH.mm}"
  pipeline: "A"
  
  indices:
    - index: "B-%{+YYYY.MM.dd.HH.mm}"
      when.equals:
        fields.B: "si"
        
  pipelines:
    - pipeline: "B"
      when.equals:
        fields.B: "si"  

setup.ilm.enabled: false
setup.template.enabled: false

Now i want to add another csv and so, a new index and a new pipeline, this is my new filebeat.yml but i can't find the new index...where is the problem?

filebeat.inputs:
- type: log
  enabled: true
  close_eof: true
  paths:
    - C:\AAAA_*.csv
  fields:
    A: "si"
    B: "no"
    C: "no"
- type: log
  enabled: true
  close_eof: true
  paths:
    - C:\BBBB_*.csv
  fields:
    A: "no"
    B: "si"
    C: "no"
- type: log
  enabled: true
  close_eof: true
  paths:
    - C:\CCCC_*.csv
  fields:
    A: "no"
    B: "no"
    C: "si"

output.elasticsearch:
  hosts: ["localhost:9200"]

  index: "A-%{+YYYY.MM.dd.HH.mm}"
  pipeline: "A"
  
  indices:
    - index: "B-%{+YYYY.MM.dd.HH.mm}"
      when.equals:
        fields.B: "si"
    - index: "C-%{+YYYY.MM.dd.HH.mm}"
      when.equals:
        fields.C: "si"
        
  pipelines:
    - pipeline: "B"
      when.equals:
        fields.B: "si"
    - pipeline: "C"
      when.equals:
        fields.C: "si"    

setup.ilm.enabled: false
setup.template.enabled: false
2

Hey, did you try running the filebeat in debug mode and see if there are any errors reported?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.