Filebeat writing to its own index

[stephenb (Stephen Brown)]

When you use modules like ngnix the index names is set in the module and overwrites the output ...

See a sample here / read this pay a special attention to the nginx input settings and explanation

How to get the sum in time of values in Lens

You can just copy the existing filebeat template and start from there it is pretty complete... or just use it as is... and change a few items like the index pattern matching ... and the write alias / ILM if you want to use them. Also this is the first time you mentioned logstash, which is fine but can add complications... not done correct it can affect the index name / results etc... (usually I suggest getting filebeat -> elasticsearch first before adding logstash) Not sure what you mean T…