Hi,
I'm creating a custom field, service.name, based on the name of the log file and determined by a processor in the filebeat inputs
filebeat.inputs:
- type: log
enabled: true
paths:
- /local/0/seal_logs/*.json
fields_under_root: true
processors:
- dissect:
tokenizer: '/local/0/seal_logs/seal-client--%{name}.json'
field: log.file.path
target_prefix: service
json.keys_under_root: true
json.add_error_key: true
json.message_key: message
However when I try and use this field name in the setup.ilm fields I'm getting key not found error. Is this possible in the filebeat yml? I'm trying to emulate something I've already achieved with central management, so would have thought you could.
setup.ilm.rollover_alias: "filebeat-seal-client-%{[service.name]}"
setup.ilm.pattern: "000001"
Adding the above to filebeat.yml yields this error
2019-07-18T11:05:44.009+0100 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://10c1eb224dab461a8d27ca2e4c18790d.dev-eu.elastic.nomura.com:9200)): Connection marked as failed because the onConnect callback failed: error loading template: error creating template instance: key not found
Many thanks,
James