Hi,
I'm new with filebeat and I have a question about template configuration.
I understand that when sending data from filebeat to elastic it is recommended to define a proper template. But, In case of data collected with filebeat is handled by Logstash before arriving to elastic, is it necessary to define a filebeat template or logstash template is enough ?
Would you mind explain to me, with an example, how looks like the output of filebeat that will be used as logstash input ?
Thank you,
Important is that the template has all fields inside that you are going to store in Elasticsearch. So if you have a template from logstash that covers your fields you are going to be fine. The template must be adjusted to the transformations you do in Logstash.
In general it also works without template, but you can hit the issue that a fields is first 0 and later 0.4 but was already detected as an integer so you will get an error.
If you want to see the structure of the filebeat output in your case, run it with -e -d "*" or use the file output and check it out there (one event per line).
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.