Setup included dashboards with custom pattern

Hi All

We have setup filebeat to create a different index based on the module used. We plan on using multiple modules, like netflow, checkpoint and many more. I have configured the ILM within the filebeat.yml using this.
setup.ilm.enabled: true
setup.ilm.rollover_alias: "netflow"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.overwrite: "true"

This create the index pattern successfully, but we also want to load the included dashboard and visualizations that comes with that module.
When loading dashboard (filebeat setup) they are still referencing the filebeat-* pattern, rather then the new defined netflow-* pattern. I have configured this also within our filebeat.yml
setup.dashboards.enabled: true
setup.dashboards.index: "netflow-*"

Is this possible or am i missing something within my filebeat.yml

filebeat.inputs:
- type: log
  enabled: false
  paths:
    - /var/log/*.log

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:
  host: "http://192.168.0.201:5601"
  username: "elastic"
  password: "test123"
  space.id: "filebeat-7-9-1"

output.elasticsearch:
  hosts: ["https://192.168.0.201:9200"]
  ssl.verification_mode: "none"
  api_key: "removed:removed"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

setup.dashboards.enabled: true
setup.dashboards.index: "netflow-*"

setup.ilm.enabled: true
setup.ilm.rollover_alias: "netflow"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.overwrite: "true"
2 Likes

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.