How can I configure the setup.template.pattern param for multiple indices in filebeat?

hi,
I configured the filebeat.yml with followings:
filebeat.inputs:

  • type: log
    enabled: true
    paths:

    • D:\ECLog\dev*.log
      fields:
      service: dev-econtract
      multiline.pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{4} [
      multiline.negate: true
      multiline.match: after
  • type: log
    enabled: true
    paths:

    • D:\ECLog\uat*.log
      fields:
      service: uat-econtract
      multiline.pattern: ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{4} [
      multiline.negate: true
      multiline.match: after
  • type: log
    enabled: true
    .....
    output.elasticsearch:
    hosts: ["IP:9200"]
    index: "%{[fields.service]}-%{+yyyy.MM.dd}"

I try to configure the setup.template.pattern as below:
setup.template.name: "npos"
setup.template.pattern: "dev-econtract-","uat-econtract-","dev-ekyc-","uat-ekyc-","dev-npos*","uat-npos*","dev-fim-","uat-fim-"

But unfortunately, it doesn't work.
Could anyone tell me how to configure this param to include all the indices I have defined for this beat?

Thanks

Have you also configured the output.index setting? If you change the template pattern you probably need to change that as well. You can find the docs here: https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.