Will filebeat create non default index if i need one?

Elastic Stack Beats
1

Hi all !

Did not get an idea of

output.elasticsearch:
    worker: 3
    hosts: ["127.0.0.1:9200"]
    index: "acc-%{[agent.version]}-%{+yyyy.MM.dd}"

Am i right that new index will be created instead of using default filebeat.... ?

2

Yes, you can! After changing the output.elasticsearch.index here as you've already done, you also need to change setup.template.name and setup.template.pattern to match your customized index name. Please see https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es for more details.

3

Thank you for replying.

Then i have a problem with it.

My filebeat.yml content is:

setup.template.enabled: true
setup.template.name: "acc-%{[agent.version]}"
setup.template.pattern: "acc-%{[agent.version]}-*"
setup.template.overwrite: true

filebeat.inputs:
  - type:
    paths:
      - C:\Users\Evgeny.Poshvin\PycharmProjects\aba\autotests-backup-core\reports\_debug_version_testcases.json
    json.keys_under_root: true
    json.add_error_key: true

output.elasticsearch:
  worker: 3
  hosts: ["127.0.0.1:9200"]
  index: "acc-%{[agent.version]}-%{+yyyy.MM.dd}"

What i suppose to get is index acc..... Template also has prefix acc... and it takes
default fields.yml.

When i run

filebeat run -c filebeat.yml

and then fill _debug_version_testcases.json with strings i still get filebeat.... default index.

What's wrong ?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.