Select template for different types of logs in Filebeat

[flowsys]

How do I configure in filebeat.yml to select different index template based on different type of filebeat inputs configured?

I was trying as below, didnt work:

filebeat.inputs:

- type: log
enabled: true
paths:
- /var/log/appA.log
tags: ["server-alias"]
fields:
app_name: appA

setup.template.name: "filebeat-%{[fields.app_name]}"
setup.template.pattern: "filebeat-%{[fields.app_name]}-*"

output.elasticsearch:
hosts: ["node01:9200","node02:9200","node03:9200"]
index: "filebeat-%{[fields.app_name]}-%{[agent.version]}-%{+yyyy.MM.dd}"

Thanks in advanced!

[faec (Fae Charlton)]

Is your goal to have a different index template for each possible value of app_name? As written I don't think what you're trying is possible (template patterns can't refer to event fields), but it's also rarely necessary. If the template pattern is "filebeat-*" then your output.elasticsearch.index setting should send everything to the correct index, and the different indices will all share a common index template, which is usually what you want.

If you do have a particular situation that depends on distinct index templates though, feel free to share more details and we can try and find a workaround

[flowsys]

@faec

everything

Thanks, your reply makes sense - " If the template pattern is "filebeat-*" then your output.elasticsearch.index setting should send everything to the correct index, and the different indices will all share a common index template, which is usually what you want."