Using custom fields in ILM setup index names

Hi,

I'm creating a custom field, service.name, based on the name of the log file and determined by a processor in the filebeat inputs

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /local/0/seal_logs/*.json
  fields_under_root: true
  processors:
  - dissect:
      tokenizer: '/local/0/seal_logs/seal-client--%{name}.json'
      field: log.file.path
      target_prefix: service
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: message

However when I try and use this field name in the setup.ilm fields I'm getting key not found error. Is this possible in the filebeat yml? I'm trying to emulate something I've already achieved with central management, so would have thought you could.

setup.ilm.rollover_alias: "filebeat-seal-client-%{[service.name]}"
setup.ilm.pattern: "000001"

Adding the above to filebeat.yml yields this error

2019-07-18T11:05:44.009+0100    ERROR   pipeline/output.go:100  Failed to connect to backoff(elasticsearch(http://10c1eb224dab461a8d27ca2e4c18790d.dev-eu.elastic.nomura.com:9200)): Connection marked as failed because the onConnect callback failed: error loading template: error creating template instance: key not found

Many thanks,
James

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.