Filebeat => logstash index

[craftytech1 (Crafty Technologies, Inc)]

I configured my filebeat client as per the instructions:
https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html

I also configured logstash as per the instructions as well:
https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html

i.e,
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

however, the indexes continue to get created as 'filebeat-*'.. I went ahead and created another template for my custom index, pretty the same as the filebeat index.
i.e,

telminov/docker-elk-server/blob/master/elasticsearch/filebeat-index-template.json

What can I do to get logstash to create an index that matches the document_type from filebeat? so far nothing that I've done seems to work.

Thanks,

[devsibwarra (Kevin)]

@craftytech1

output { elasticsearch { hosts => ["http://localhost:9200"] index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" }}

In your example, the output.elasticsearch.index setting is using %{[@metadata][beat]}- which would map to filebeat-, metricbeat-, etc. Try changing that to %{[@metadata][type]}- or some static content that your index template is setup to match

[craftytech1 (Crafty Technologies, Inc)]

that works! Thanks!