How to put each file name as index name to store Elasticsearch via Filebeat


How can I put each filename as index name to store elasticsearch via filebeat?

i am using Filebeat to send log files to elasticsearch via logstash conf. i am using wildcard(*) to get all of the files in directories.

Now it works like all of my logs stored one index in Elasticsearch and i don't want this. I need separately indexing for each log file.

Filebeat harvester is processing all of my files in the directories but I need the filename of my logs separately to index_name to store elasticsearch via logstash conf file. I can't put each processed log file name to conf file output.elasticsearch.index_name.

I think this should be possible because i have seen the exact path for each file(and of course file_name) both logstash logs([log.file.path]) and filebeat logs(called source_file). When i put that index name in the format of %{[ ]}, it doesn't give me dynamic value, just storing what i wrote for index name...

I have already tried these difference approaches:
index => "%{[@metadata][log.file.path]}-%{[log.file.path]}-%{[source_file]}"

wildcard path

logstash conf file:

Thanks in advance!

Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.