Filebeat, Ingest and ES index name pattern

Elastic Stack Beats
1

Hi,

I've have filebeat setup to ship logs to elasticsearch and the logs are then parsed by a ingest pipeline. Now in filebeat i have a index pattern defined like this:

output.elasticsearch:
  hosts:
    - localhost:9200
  index: filebeat-%{[beat.version]}-%{+yyyy.MM.dd}

If you then send logs which were generated yesterday they will be written to the today index. is there any way to fix this problem without adding logstash in between?

2

i'm just noticeing https://www.elastic.co/guide/en/elasticsearch/reference/master/date-index-name-processor.html

Will try that!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.