Filebeat Index Issue - template pattern / name

Elastic Stack Beats
2

Your config seems to be incorrect. setup.template.* should not go under output.elasticsearch. It stands in the root of the config, as seen here:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["192.168.1.199:9200"]
  index: "desktop-%{[beat.version]}-%{+yyyy.MM.dd}"
  indices:
    - index: "critical-%{[beat.version]}-%{+yyyy.MM.dd}"
      when.contains:
        message: "CRITICAL"
    - index: "error-%{[beat.version]}-%{+yyyy.MM.dd}"
      when.contains:
        message: "ERR"

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  username: "elastic"
  password: "blah"

  timeout: 180
  bulk_max_size: 2

setup.template.name: "desktop"
setup.template.pattern: "desktop-*"
1 Like