Filebeat to elasticsearch configuration(mapping)

[tkkchan]

Dear All,
I am currently trying to put some files into ES using Filebeat, and meanwhile I want to see if I can set the mapping(with Filebeat, without calling API for ES). As I see from some logstash config, there's a way to do it, like below:

output {
    stdout { codec => rubydebug }
    elasticsearch {
        hosts => [ "localhost:9200" ]
        index => "your_index"
        template => "mapping.json"
        template_overwrite => true

}

Is there a way to do this in filebeat.yml? if so, could you please show me the correct syntax?

Right now my filebeat.yml output section looks like this

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "your_index"

Cheers,
TK

[ndtreviv (Nathan Trevivian)]

Yes, this is possible. Take a look at this:

Configure Elasticsearch index template loading | Filebeat Reference [7.12] |...

So you'll need something like:

setup.template.name: your-index
setup.template.pattern: your-index-*
setup.template.fields: "your-index-fields.yml"
setup.template.overwrite: true

and then under the output.elasticsearch section something like:

  index: "your-index-%{+yyyy.MM.dd}"

For a reference of what should be in your-index-fields.yml, take a look at the fields.yml that comes installed in /etc/filebeat/fields.yml

[tkkchan]

Dear Nathan,
thank you very much indeed!