What kind of special parameters can be used in filebeat.yml?

Elastic Stack Beats
1

Hello,
Its a bit unclear what kind of special parameters can be used in filebeat.yml
Specificly, I'm reffering to parameters of the elasticsearch output section.
For example the index name can be set with date:
index: 'filebeat-%{+yyyy.MM.dd}'

Another example I saw in some other discussion is that I can refer to fields from the log output.

My question is what else can be done with the % sign? Can I write some Go (or other language) code? For example to get a substring from a field value, and that will be part of the index name?

Thanks.

2

Have you read the documentation section for the "Config file format"? There is a section addressing format strings that says how to use parameters and how to format dates. Hopefully that helps if you haven't seen it.

3

Thanks Andrew, thats what I was looking for.
I guess I missed it because I was looking specifically at the Filebeat
documentation. I think I'll have a look at the Beats documentation to see
that I haven't skipped some more important info, like the above.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.