The filebeat default index cannot be changed

This is my filebeat.yml configuration:

#=========================== Filebeat inputs =============================

filebeat.inputs:


- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*


#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 3
#setup.template.enabled: false
  #index.codec: best_compression
  #_source.enabled: false

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
host: "123.20.12.236:5601"
# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["11.159.11.12:9200"]
  output.elasticsearch.index: "test-%{[beat.version]}"
  setup.template.name: "test"
  setup.template.pattern: "test-"
  setup.dashboards.index: "test-"







You made your setup* settings children of output.elasticsearch. Don't indent them under output.elasticsearch. For example see Something is wrong with pipeline.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.