Optional fields in filebeat

Elastic Stack Beats
1

Hi,
I was using LSF with below extra fields in LSF.conf
type and Application as below.

{
"paths": [ 
"C:/logs/user-mgmt/user-mgmt.log"
],
"fields": { "type": "iam-logs","Application":"iam" }
}

And I was creating timebased index in logstash-indexer at server side in the name of {%Application%}-YYYY-MM-DD
Now, in filebeat there is facility to define index name as well at client side only.

  1. So can anybdoy confirm that I should go ahead with indexing form filebeat ?
  2. If I am defining index in FB configuration only then, do I need to mention index parameter in elasticsearch output in logstash-indexer?

Please guide me which approach is better? indexing in FB or the old approach of timebased indexing from LS-indexer conf.?

br,
Sunil

2

Filebeat by default creates daily indices. No configuration needed.

3

Hi,
thanks Ruflin.
So, if I understand correctly, after FB, logstash role is mainly for filtering,parsing.

4

Exactly. Filtering, parsing / processing, enhancing and routing to different outputs.