Multiple metricbeat index for each host

Elastic Stack Beats
1

Currently i am sending metricbeat data from all the server directly to elastichost:9200. This way metricbeat data from all the server sends data to single metricbeat-dataIs it possible to create separate index for metricbeat data from each server. Current metricbeat configuration is like below.

metricbeat.yml:
metricbeat.modules:

#------------------------------- System Module -------------------------------

  • module: system
    metricsets:
    • cpu
    • load
    • filesystem
    • fsstat
    • memory
    • network
    • process
      enabled: true
      period: 10s
      processes: ['.*']

output.elasticsearch:
hosts: ["elastichost:9200"]

For example, I looking for separate metricbeat index for each host.
metricbeat-host1-dd-mm-yy
metricbeat-host2-dd-mm-yy

2

You can change the index` setting.

E.g.

output.elasticsearch:
  index: 'metricbeat-%{[beat.version]}-%{[beat.name]}-%{+yyyy.MM.dd}'

This way the index-name is still versioned by the beat version (required to the template mapping still to be applied). I'm using beat.name here. The hostname is stored in beat.hostname. The beat.name is the hostname by default, but can be reconfigured using the global name setting in beats.

3

Nice and simple. I will try this and let you know. Thanks Steffens.

4

Before making this change, be aware that having a large number of small indices can be very inefficient.

5

This is what i was looking for. Initially i thought to send to logstash and create separate index using logstash output. But this creates directly in ES.
@Christian_Dahlqvist - I am using this option for one or two servers to monitor and retain the index for a month.
Thanks team for your help.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.