Filebeat on Windows not indexing into name on yml

New to Beats, trying to figure out why Filebeat is sending data to ES in the default file index name filebeat--, when my yml configuration states that I want it to go into logs_server1:
filebeat.inputs:

- type: log
  enabled: true
  paths:
    - c:\\Users\\ ... logs_server1\\*.log

processors:
  - decode_json_fields:
      fields: ["message"]
      target: ""

  - drop_fields:
      fields: ["message"]

setup.template.enabled: false

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "logs_server1"
  bulk_max_size: 25

logging.level: debug
logging.selectors: ["*"]

On the command line, I have tried
.\filebeat.exe setup --index-management -E setup.ilm.overwrite=true -c ..\data\filebeat3.yml

and

.\filebeat.exe setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]' -c ..\data\filebeat3.yml

Thanks for any help.

hi @math1324,

If you change index setting inside output.elasticsearch, you also need to configure the setup.template.name and setup.template.pattern options (see Elasticsearch index template ).

If you are using the pre-built Kibana dashboards, you also need to set the setup.dashboards.index option (see Kibana dashboards ).

Let us know if that worked in your case.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.