Hello, Please i'm searching for a way to index beats hourly in elasticsearch. As you know the default configuration in a beat yml file is : #index: "winlogbeat-%{[agent.version]}-%{+yyyy.MM.dd}" I tried changing that line to this : #index: "winlogbeat-%{[agent.version]}-%{+yyyy.MM.dd.HH}" But i…

Indexing beats hourly

warkolm (Mark Walkom) September 15, 2021, 9:24pm 2

Can I ask why you want to go this route? You risk creating a lot of shards, and wasting system resources due to that.

Topic		Replies	Views
Hourly index for filebeat Beats filebeat	13	6011	January 5, 2017
Index Management of beats Elasticsearch	1	324	April 11, 2020
Indexes with FileBeat Beats filebeat	8	4429	September 27, 2016
Beats Pipeline blocked on the hour Logstash	10	865	December 16, 2016
Multiple ElasticSearch Indexes in Logstash Output Logstash	2	2238	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Indexing beats hourly

Related topics