issy
July 29, 2022, 1:21pm
1
I'm trying to have custom indices for different filebeat modules.
In this example i want to have a custom indices for the apache module, but it doesn't seem to work.
indices:
- index: "filebeat-%{[agent.version]}-apache-error"
when.equals:
event.module: "apache"
setup.template.enabled: true
setup.template.name: "filebeat-%{[agent.version]}"
setup.template.pattern: "filebeat-%{[agent.version]}-*"
setup.template.fields: "fields.yml"
setup.ilm.enabled: false
Any help is appreciated, thanks!
rugenl
(Len Rugen)
July 29, 2022, 4:18pm
2
I doubt it will do the setup for multiple indices. Try creating your own templates and bootstrap the initial indices.
I think your index "when" logic is only valid in the output section.
See Filebeat- Multiples modules output to multiples indexes.
FYI - These output methods are completely invalidated by the new data streams obfuscation of indexing.
system
(system)
Closed
August 26, 2022, 6:19pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.