Winlogbeat Can create diiferent indices

Elastic Stack Beats
1

instead of having Winlogbeat create daily indices We can create separate index for logs from different client(Different machine) to one elasticsearch server

2

I guess you are looking for output.elasticsearch.index or output.elasticsearch.indices settings. The docs show how this can be done.

3

yah I think so...I am sending logs to logstash using winlogbeat and then to elasticsearch

Where i want to change this settings?
in logstash config file?

4

These are setting in the elasticsearch output in winlogbeat. If you send to logstash, then you can not use those settings. You will have to do filtering/routin in logstash. Check out index setting in logstash elasticsearch output

5

But There is no these kind of settings in logstash index?

What can i do?

6

See index setting. You can reuse any field available in your event or in @metadata (fields in @metadata will not be send to Elasticsearch).

7

What I cannot get it? could you explain little bit?

8

In Logstash you can configure the index to be:

output {
  elasticsearch {
    ...
    index => "%{[@metadata][index]}-%{+yyyy.MM.dd}"
  }
}

In this example the @metadata.index field will be used as base name. Using conditionals in filter, you can set this field to whatever you need.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.