Will filebeat create non default index if i need one?

Hi all !

Did not get an idea of

    worker: 3
    hosts: [""]
    index: "acc-%{[agent.version]}-%{+yyyy.MM.dd}"

Am i right that new index will be created instead of using default filebeat.... ?

Yes, you can! After changing the output.elasticsearch.index here as you've already done, you also need to change setup.template.name and setup.template.pattern to match your customized index name. Please see https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#index-option-es for more details.

Thank you for replying.

Then i have a problem with it.

My filebeat.yml content is:

setup.template.enabled: true
setup.template.name: "acc-%{[agent.version]}"
setup.template.pattern: "acc-%{[agent.version]}-*"
setup.template.overwrite: true

  - type:
      - C:\Users\Evgeny.Poshvin\PycharmProjects\aba\autotests-backup-core\reports\_debug_version_testcases.json
    json.keys_under_root: true
    json.add_error_key: true

  worker: 3
  hosts: [""]
  index: "acc-%{[agent.version]}-%{+yyyy.MM.dd}"

What i suppose to get is index acc..... Template also has prefix acc... and it takes
default fields.yml.

When i run

filebeat run -c filebeat.yml

and then fill _debug_version_testcases.json with strings i still get filebeat.... default index.

What's wrong ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.