Filebeat does not set the index for logstash output even after providing index name in filebeat


(Rupesh Ranjan) #1

In my filebeat.full.yml file, i have set the following configuration

output.logstash:
enabled: true
hosts: ["localhost:5043"]
index: "testing-%{+yyyy.MM.dd}"

Even after this, the index name appears as "logstash-%{+yyyy.MM.dd}".
I do not want to set the index name in logstash config file separately.
Any suggestions, how can i set the index name as "testing-%{+yyyy.MM.dd}"?

P.S. I am using version 5.0.1 fro both filebeat and logstash.


(Steffen Siering) #2

the index name must be set in logstash. The default pattern we provide in getting started docs for logstash also uses logstash to set the index name based on timestamp.


(Rupesh Ranjan) #3

Thank you,
Can you tell me then, what the index in the question that i have posted, used for?


(Steffen Siering) #4

The index field configured in logtash output in beats will be available in logstash via [@metadata][beat]. By default the value is filebeat.

Here is an example using [@metadata][beat] to configure the index pattern in logstash elasticsearch output.


(system) #5

This topic was automatically closed after 21 days. New replies are no longer allowed.