Filebeat on Windows not indexing into name on yml

Elastic Stack Beats
1

New to Beats, trying to figure out why Filebeat is sending data to ES in the default file index name filebeat--, when my yml configuration states that I want it to go into logs_server1:
filebeat.inputs:

- type: log
  enabled: true
  paths:
    - c:\\Users\\ ... logs_server1\\*.log

processors:
  - decode_json_fields:
      fields: ["message"]
      target: ""

  - drop_fields:
      fields: ["message"]

setup.template.enabled: false

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "logs_server1"
  bulk_max_size: 25

logging.level: debug
logging.selectors: ["*"]

On the command line, I have tried
.\filebeat.exe setup --index-management -E setup.ilm.overwrite=true -c ..\data\filebeat3.yml

and

.\filebeat.exe setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]' -c ..\data\filebeat3.yml

Thanks for any help.

2

hi @math1324,

If you change index setting inside output.elasticsearch, you also need to configure the setup.template.name and setup.template.pattern options (see Elasticsearch index template ).

If you are using the pre-built Kibana dashboards, you also need to set the setup.dashboards.index option (see Kibana dashboards ).

Let us know if that worked in your case.