Is there any way (without disabling ILM) to have Filebeat use a different index for each enabled module? This was easy before ILM by adding conditions to the output.elasticsearch.indices:
But I'm having a very hard time finding information on how to accomplish something similar with ILM. Do I have to disable it to get this functionality?
Ithink you can, I have Logstash using variables in the index name to write to different indices for each different value of that variable.
you will probably have to have a template for each different index pattern (see example below)
filebeat's setup probably won't do it
you will have create the first index for each pattern before you write to it. doc
if you want the create date in the index name, dothis
A sample ILM template. I use a higher priority, so it includes the default filebeat-%{{agent.version}} template, then adds ILM for this particular index pattern.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.