Optional fields in filebeat

(Sunil Chaudhari) #1

I was using LSF with below extra fields in LSF.conf
type and Application as below.

"paths": [ 
"fields": { "type": "iam-logs","Application":"iam" }

And I was creating timebased index in logstash-indexer at server side in the name of {%Application%}-YYYY-MM-DD
Now, in filebeat there is facility to define index name as well at client side only.

  1. So can anybdoy confirm that I should go ahead with indexing form filebeat ?
  2. If I am defining index in FB configuration only then, do I need to mention index parameter in elasticsearch output in logstash-indexer?

Please guide me which approach is better? indexing in FB or the old approach of timebased indexing from LS-indexer conf.?


(ruflin) #2

Filebeat by default creates daily indices. No configuration needed.

(Sunil Chaudhari) #3

thanks Ruflin.
So, if I understand correctly, after FB, logstash role is mainly for filtering,parsing.

(ruflin) #4

Exactly. Filtering, parsing / processing, enhancing and routing to different outputs.

(system) #5