To set an index name with filebeat

[jang (mingyu)]

hello,
I pass the log to logstash via Filebit.
I currently collect logs from three path.
I'm trying to set index name on the filebit.
I want to set an index name for each path.
How can I set each index name?

now setting

filebeat.inputs:

  - type: log
    enabled: true
    paths:
      - C:\Temp\test1.log
      - C:\Temp\test2.log
      - C:\Temp\test3.log

output.logstash:
  hosts: ["address:5044"]
  index: "test1"

[Wolfram_Haussig]

Hello,

Welcome to this forum. As you are sending the logs to LogStash FileBeat does not know about ElasticSearch and cannot set the index.

Basically, if you want to create different indexes based on the paths test1.log, test2.log, test3.log you could:

1. Map the paths received from FileBeat to the index name using a LogStash filter.
2. Depending on the fact if you use ILM or not you can either set the index or ILM settings to contain the generated index name.

Here is a good description.

Best regards
Wolfram