New to Beats, trying to figure out why Filebeat is sending data to ES in the default file index name filebeat--, when my yml configuration states that I want it to go into logs_server1:
filebeat.inputs:
- type: log
enabled: true
paths:
- c:\\Users\\ ... logs_server1\\*.log
processors:
- decode_json_fields:
fields: ["message"]
target: ""
- drop_fields:
fields: ["message"]
setup.template.enabled: false
output.elasticsearch:
hosts: ["localhost:9200"]
index: "logs_server1"
bulk_max_size: 25
logging.level: debug
logging.selectors: ["*"]
On the command line, I have tried
.\filebeat.exe setup --index-management -E setup.ilm.overwrite=true -c ..\data\filebeat3.yml
and
.\filebeat.exe setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]' -c ..\data\filebeat3.yml
Thanks for any help.