Hi there,
Hi have a very basic ES setup with winlogbeat configured with default options everywhere.
By default, Winlogbeat loads index templates named winlogbeat-%{[agent.version]}-* in ES. Because of that, any changes I would make on the template will be lost next time winlogbeat is upgraded, right ?
So can I just deactivate the automatic template loading and create one myself ? I assume there might be a good reason why a new template is created on each upgrade though ?
My ultimate goal is simply to specify an ingest pipeline because some data is not the right type.
Thanks