Set "Time Filter field" name from filebeat

Elastic Stack Beats
1

From filebeat, If I create default template name, by default takes @timestamp but what I want is I need to pass logtimestamp as default time filter field.

setup.template.name: "org-n4-apex"
setup.template.pattern: "org-n4-apex"
setup.dashboards.index: "org-apex-*"

I understand it needs to be in date format. So with that, how do i set one date field as default time filter field from filebeat.?

2

Would appreciate reply

3

@Kathir_J I think if I undestand correctly, you want to create an index based on the date of another field and not the @timestamp? If this is correctly you have to use the pipeline for the Ingest Node to achieve that. First you will need to parse the date with the Date Processor and use the Date Index Name Processor to correct use that field as the index name.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.