Should I keep beat version in index-template?

Hi there,

Hi have a very basic ES setup with winlogbeat configured with default options everywhere.
By default, Winlogbeat loads index templates named winlogbeat-%{[agent.version]}-* in ES. Because of that, any changes I would make on the template will be lost next time winlogbeat is upgraded, right ?
So can I just deactivate the automatic template loading and create one myself ? I assume there might be a good reason why a new template is created on each upgrade though ?

My ultimate goal is simply to specify an ingest pipeline because some data is not the right type.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.