Pointing output.conf to a custom added template

Elastic Stack Logstash
1

i created a new index template in elasticsearch, which is just a copy-paste of the default logstash template except i renamed it x_logs and put "template" : "x_logs-*"

my output.conf has this
if [type] == x_logs {
elasticsearch {
host => localhost
protocol => "http"
manage_template => false
index => "x_logs-%{+YYYY.MM.dd}"
}
}

is this the correct method of telling logstash to use that new index template for x_logs? am i missing something?

2

Are you saying that you yourself have created the index template in Elasticsearch and don't want Logstash to do anything related to index templates? Then yes, you're doing the right thing (the manage_template parameter is the key).

3

i believe thats what im trying to achieve. i created an index template in ES. i want x_logs from logstash to go and use that index template.

4

server was rebooted and logs are now coming in. :slight_smile: