# Metricbeat and Logstash

**URL:** https://discuss.elastic.co/t/metricbeat-and-logstash/275391
**Category:** Beats
**Tags:** metricbeat
**Created:** [June 9, 2021, 7:41am UTC](https://discuss.elastic.co/t/metricbeat-and-logstash/275391 "2021-06-09T07:41:24Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![stefan0s](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@stefan0s](https://discuss.elastic.co/u/stefan0s)
#### Post date: [June 9, 2021, 7:41am UTC](https://discuss.elastic.co/t/metricbeat-and-logstash/275391/1 "2021-06-09T07:41:24Z")

</div>

Hello,

I have installed logstash to collect logs and send to elasticsearch. Logstash is configured to keep indexes in hourly base.

I need now to install metricbeat modules and also send to elasticsearch in hourly base index as well. In metricbeat configuration i can send directly to elastic but i see no index configuration. Is it better to send to logstash (and not directly to elastic) and configure logstash for the indexes?

Thank you

---

<div class="post-metadata">

### Author: ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [June 15, 2021, 8:31am UTC](https://discuss.elastic.co/t/metricbeat-and-logstash/275391/2 "2021-06-15T08:31:54Z")

</div>

Hi @stefan0s 🙂 Welcome to the forum

You can send data through Logstash but maybe you can solve your problem with the info in the next link [Configure the Elasticsearch output | Metricbeat Reference [7.13] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/current/elasticsearch-output.html#index-option-es)

---

<div class="post-metadata">

### Author: ![stefan0s](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@stefan0s](https://discuss.elastic.co/u/stefan0s)
#### Post date: [June 15, 2021, 9:01am UTC](https://discuss.elastic.co/t/metricbeat-and-logstash/275391/3 "2021-06-15T09:01:00Z")

</div>

Hello Mario,

While adding index: "%{[fields.log\_type]}-%{[agent.version]}-%{+yyyy.MM.dd}" to metricbeat.yml i receive the error bellow and service cannot start:

The metricbeat service failed to start due to the following error:  
The service did not respond to the start or control request in a timely fashion.

By removing the index row added previously service cannot start at all now. All line endings have LF. We are using windows. I also see in the logs

Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified

Any suggestions?

---

<div class="post-metadata">

### Author: ![stefan0s](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@stefan0s](https://discuss.elastic.co/u/stefan0s)
#### Post date: [June 15, 2021, 10:43am UTC](https://discuss.elastic.co/t/metricbeat-and-logstash/275391/4 "2021-06-15T10:43:53Z")

</div>

Ok it seems that template.name and template.pattern is required even id we use the default index "metricbeat-%{[agent.version]}-%{+yyyy.MM.dd}". I have now configured index as  
index: "%{[fields.log\_type]}-%{[agent.version]}-%{+yyyy.MM.dd.HH}"

and also set

setup.template.name: "metricbeat"  
setup.template.pattern: "metricbeat-\*"

but indexes in elastic are like: metricbeat-7.12.1-2021.06.15-000001

Should be in hourly index basis?? I have set the .HH

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2021, 12:44pm UTC](https://discuss.elastic.co/t/metricbeat-and-logstash/275391/5 "2021-07-13T12:44:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.