Filebeat won't create custom indices

I'm trying to have custom indices for different filebeat modules.

In this example i want to have a custom indices for the apache module, but it doesn't seem to work.

indices:
- index: "filebeat-%{[agent.version]}-apache-error"
when.equals:
event.module: "apache"

setup.template.enabled: true
setup.template.name: "filebeat-%{[agent.version]}"
setup.template.pattern: "filebeat-%{[agent.version]}-*"
setup.template.fields: "fields.yml"
setup.ilm.enabled: false

Any help is appreciated, thanks!

I doubt it will do the setup for multiple indices. Try creating your own templates and bootstrap the initial indices.

I think your index "when" logic is only valid in the output section.

See Filebeat- Multiples modules output to multiples indexes.

FYI - These output methods are completely invalidated by the new data streams obfuscation of indexing.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.