Filebeat modules es index names

Elastic Stack Beats
1

i'm using filebeat's suricata and zeek modules, everything works great as long as i dont mess with the index names..

my issue is i have multiple sources sending in data from multiple locations..
right now everything is feeding into filebeat-7.1.1 (alias) then its creating indexes that roll over.. (i think thats how it is working)

i'd like to be able to have the names filebeat-7.1.1-building1, filebeat-7.1.1-building2

when i modify the index name in any way via logstash, everything goes to hell.. the processing/piplelines done seem to work..
-- suricata logs stop saying suricata and just say "json"
-- dashboards stop being linked to data

any suggestions.. i've googled all i know to google.. and i'd searched this discussion board every way i know how.

thank you

2
  1. Could you provide Filebeats & logstash config.
  2. Did you try enabling debug logs in logstash to see what's going wrong
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.