I can't redirect output to a custom index

Elastic Stack Beats
1

I can't redirect output to a custom index from a filebeat. It constantly loads the default filebeat template 7.3.1. Any idea where should I look? Logs are getting send to the filebeat-* index.

#==================== Elasticsearch template setting ==========================
setup.template.enabled: false
setup.template.name: 'NEW_INDEX_NAME'
setup.template.pattern: 'NEW_INDEX_NAME-*'
setup.template.settings:
   index.number_of_shards: 1
#index.codec: best_compression
#_source.enabled: false
2 
output.elasticsearch.index: "customname-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "customname"
setup.template.pattern: "customname-*"

I think output.elasticsearch.index is the setting you want here.

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html

3

Add the following configuration to filebeat
"setup.ilm.enabled: false"

4

It's a known issue :slight_smile:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.