Metricbeat add fields in index elasticsearch

Elastic Stack Beats
1

Hello

I am using Metricbeat and I want to name each Elasticsearch index specifically so I tried this:
elasticsearch {
hosts => [ "172.17.0.22:9200" ]
index => "idx-metricbeat-%{fields.meta_app}-%{+YYYY.MM.dd}"
flush_size => 100
idle_flush_time => 1
template => "/etc/logstash/templates.d/metricbeat.template.json"
template_name => "metricbeat"
template_overwrite => true
document_type => "logs"
}

Where "meta_app" is part of metricbeat logs:
"fields" => {
"meta_env" => "pp",
"meta_app" => "plm",
"meta_com" => "system",
}

But for now, Logstash is not able to name correctly the elasticsearch index, here is the index generated:
idx-metricbeat-%{fields.meta_app}-2017.07.03

Thanks for your help.

Regards

2

Seems to be Logstash, not beats.

The format string syntax for accessing fields requires you to use [] to access fields...

this should help:

index => "idx-metricbeat-%{[fields][meta_app]}-%{+YYYY.MM.dd}"
3

it's working!
Thanks a lot

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.