How can I configure the setup.template.pattern param for multiple indices in filebeat?

Elastic Stack Beats
1

hi,
I configured the filebeat.yml with followings:
filebeat.inputs:

  • type: log
    enabled: true
    paths:

    • D:\ECLog\dev*.log
      fields:
      service: dev-econtract
      multiline.pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{4} [
      multiline.negate: true
      multiline.match: after

  • type: log
    enabled: true
    paths:

    • D:\ECLog\uat*.log
      fields:
      service: uat-econtract
      multiline.pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{4} [
      multiline.negate: true
      multiline.match: after

  • type: log
    enabled: true
    .....
    output.elasticsearch:
    hosts: ["IP:9200"]
    index: "%{[fields.service]}-%{+yyyy.MM.dd}"

I try to configure the setup.template.pattern as below:
setup.template.name: "npos"
setup.template.pattern: "dev-econtract-","uat-econtract-","dev-ekyc-","uat-ekyc-","dev-npos*","uat-npos*","dev-fim-","uat-fim-"

But unfortunately, it doesn't work.
Could anyone tell me how to configure this param to include all the indices I have defined for this beat?

Thanks

2

Have you also configured the output.index setting? If you change the template pattern you probably need to change that as well. You can find the docs here: https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.