Filebeat, Ingest and ES index name pattern


(Atze De Vries) #1

Hi,

I've have filebeat setup to ship logs to elasticsearch and the logs are then parsed by a ingest pipeline. Now in filebeat i have a index pattern defined like this:

output.elasticsearch:
  hosts:
    - localhost:9200
  index: filebeat-%{[beat.version]}-%{+yyyy.MM.dd}

If you then send logs which were generated yesterday they will be written to the today index. is there any way to fix this problem without adding logstash in between?


(Atze De Vries) #2

i'm just noticeing https://www.elastic.co/guide/en/elasticsearch/reference/master/date-index-name-processor.html

Will try that!


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.