Filebeat Logstash Multiple Index error

[rvjagadheesh (Jagadheesh Venkatesan)]

Why this config is not creating indexes in Kibana for Filebeat Logstash Multiple Indexes. Using 7.1.1 version

filebeat.yml

#=========================== Filebeat inputs =============================

filebeat.inputs:

• type: log

  enabled: true
  paths:

  • c:\elk-stack\data_files\data*.log
    fields:
    type: "data"

• type: log
  enabled: true
  paths:

  • c:\elk-stack\data_files\winemag*.log
    fields:
    type: "winemagservice"

#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["localhost:5044"]
index: "index-%{[fields.type]:other}"

logstash.conf

input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

[shaunak (Shaunak Kashyap)]

Hi @rvjagadheesh and welcome to the Elastic community.

Could you please post your Filebeat log here? Maybe that will give us a clue as to what's going on. Please be sure to mask any sensitive information in the log before posting it.

Also, could you try to temporarily disable the Logstash output in filebeat and use the Console output instead, just for debugging purposes? This will at least tell us if the issue is somewhere on the Filebeat side or the Logstash side.

Thanks,

Shaunak