Logstash config with filebeat fields


 I have filebeat installed on all my dev server and qa server in my filebeat config i have added the field as env: dev and env:qa  how do i use this in my logstash config output index pattern. i tried this method but its not working  index =>"%{env} -%{+YYYY.MM.dd}"  


What result to you get? What do you mean by "its not working"?

Hi ,

i am getting this error .
Invalid index name [%{env} -2019.01.30]


That's invalid because it contains a space character, but if that's what you get in the error message it may mean %{env} was not substituted because the env field does not exist.

There is a space in the index name and that is not alllowed...


index =>"%{env} -%{+YYYY.MM.dd}"


index =>"%{env}-%{+YYYY.MM.dd}"

That should clear up your error...


Since i have added in my filebeats.yml
env: qa

I am getting this same in my output. But still the index pattern is not working as expected . (example env:dev env:qa)


Have you looked at an event in Kibana? Does it have an env field? If you do not set fields_under_root then you may have [fields][env] instead of [env].


Yes in my kibana events i am getting as fields.env:qa but still i am not able to index this pattern as qa or dev


OK. So try

index =>"%{[fields][env]}-%{+YYYY.MM.dd}"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.