Indexing beats hourly

Elastic Stack Beats
, , ,
1

Hello,

Please i'm searching for a way to index beats hourly in elasticsearch. As you know the default configuration in a beat yml file is :

#index: "winlogbeat-%{[agent.version]}-%{+yyyy.MM.dd}"

I tried changing that line to this :

#index: "winlogbeat-%{[agent.version]}-%{+yyyy.MM.dd.HH}"

But it doesn't work.
Is there any way to index beats hourly ? (Plesase consider that i'm not using logstash between beats and elsticsearch)
Thank you in advance for your help.

2

Can I ask why you want to go this route? You risk creating a lot of shards, and wasting system resources due to that.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.