The filebeat default index cannot be changed

Elastic Stack Beats
1

This is my filebeat.yml configuration:

#=========================== Filebeat inputs =============================

filebeat.inputs:


- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*


#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 3
#setup.template.enabled: false
  #index.codec: best_compression
  #_source.enabled: false

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
host: "123.20.12.236:5601"
# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["11.159.11.12:9200"]
  output.elasticsearch.index: "test-%{[beat.version]}"
  setup.template.name: "test"
  setup.template.pattern: "test-"
  setup.dashboards.index: "test-"
2

You made your setup* settings children of output.elasticsearch. Don't indent them under output.elasticsearch. For example see Something is wrong with pipeline.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.