I upgraded from 5.6.3 to 6.0 and i have two question:
- Need upgrade all beat to 6.0 ? v5.6.x conflict with ES 6.0.0?
- I got %{[@metadata][beat]}-%{[@metadata][version]}-2017-37 in index name.
Flow data : beat -> LS forwarder -> RabbitMQ -> LS Proccessor -> ES.
Config in LS forwarder
input {
beats {
port => 5044
}
}
filter {
if [type] == "wineventlog" and [event_id] == 5156 {
drop { }
}
mutate {
add_field => {"beatname" => "%{[@metadata][beat]}"}
add_field => {"beattype" => "%{[@metadata][type]}"}
add_field => {"beatversion" => "%{[@metadata][version]}"}
}
}
output {
rabbitmq {
exchange => "logstash"
exchange_type => "direct"
key => "logstash-key"
host => "10.1.100.10"
vhost => "elastic-stack"
durable => true
persistent => true
port => 5677
user => "logstash"
password => "password"
}
}
Confing LS Proccessor
input {
rabbitmq {
host => "10.1.100.10"
queue => "logstash-queue"
key => "logstash-key"
exchange => "logstash"
threads => 5
exclusive => false
prefetch_count => 256
vhost => "elastic-stack"
port => 5677
user => "logstash"
password => "password"
}
}
output {
elasticsearch {
hosts => ["http://node1:9200", "node2:9200", "node3:9200"]
user => "user"
password => "passs"
manage_template => false
index => "%{beatname}-%{beatversion}-%{+xxxx.ww}"
#index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+xxxx.ww}"
document_type => "%{beattype}"
}
}
Somehing wrong in my config? . This config is worked with 5.6.x. i just add more field beatversion for 6.0