Unable to create monthly index in filebeat to elasticsearch

Hi Team,

I am trying to sending logs from couple of my windows servers using filebeat to elasticsearch directly. The index patterns are getting created by default ( filebeat-7.10.2-2021.08.16) however I want to create a custom index name for each of the servers. also I want them to be on monthly index.

I tried with the below since I have my ILM policy disabled
output.elasticsearch.index: "solrlogsuat.35-%{[agent.version]}-%{+yyyy.MM}"
setup.template.name: "solrlogsuat.35"
setup.template.pattern: "solrlogsuat.35-*"

Once I restart, the filebeat seems to run fine however I dont see the index getting created in ES. Can someone pls help

This the yml config

  • type: log
    • D:\solr\solr-7.3.0\server\logs*.log
      logtype: "Seal_SOLR_Logs"
      device: "SealUAT-"
      enabled: true
      reload.enabled: true
      reload.period: 10s
      setup.ilm.enabled: false
      setup.ilm.check_exists: false
      output.elasticsearch.index: "solrlogsuat.35-%{[agent.version]}-%{+yyyy.MM.dd}"
      setup.template.name: "solrlogsuat.35"
      setup.template.pattern: "solrlogsuat.35-"
      hosts: ["

Can you share the entire config file.

Please also format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you :slight_smile:

Hi ,

Thanks for the reply

I was able to fix the issue by using the below in output section

- Indices
     - index:  "solrlogsuat-%{YYYY.MM}"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.