Filebeat won't create custom indices

Elastic Stack Beats
#1

I'm trying to have custom indices for different filebeat modules.

In this example i want to have a custom indices for the apache module, but it doesn't seem to work.

indices:
- index: "filebeat-%{[agent.version]}-apache-error"
when.equals:
event.module: "apache"

setup.template.enabled: true
setup.template.name: "filebeat-%{[agent.version]}"
setup.template.pattern: "filebeat-%{[agent.version]}-*"
setup.template.fields: "fields.yml"
setup.ilm.enabled: false

Any help is appreciated, thanks!

#2

I doubt it will do the setup for multiple indices. Try creating your own templates and bootstrap the initial indices.

I think your index "when" logic is only valid in the output section.

See Filebeat- Multiples modules output to multiples indexes.

FYI - These output methods are completely invalidated by the new data streams obfuscation of indexing.