Filebeat => logstash index

Elastic Stack Logstash
1

I configured my filebeat client as per the instructions:
https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html

I also configured logstash as per the instructions as well:
https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html

i.e,
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

however, the indexes continue to get created as 'filebeat-*'.. I went ahead and created another template for my custom index, pretty the same as the filebeat index.
i.e,

What can I do to get logstash to create an index that matches the document_type from filebeat? so far nothing that I've done seems to work.

Thanks,

2

In your example, the output.elasticsearch.index setting is using %{[@metadata][beat]}- which would map to filebeat-, metricbeat-, etc. Try changing that to %{[@metadata][type]}- or some static content that your index template is setup to match

3

that works! Thanks!