Winlogbeat Can create diiferent indices

(Dv Thiyanesh) #1

instead of having Winlogbeat create daily indices We can create separate index for logs from different client(Different machine) to one elasticsearch server

(Steffen Siering) #2

I guess you are looking for output.elasticsearch.index or output.elasticsearch.indices settings. The docs show how this can be done.

(Dv Thiyanesh) #3

yah I think so...I am sending logs to logstash using winlogbeat and then to elasticsearch

Where i want to change this settings?
in logstash config file?

(Steffen Siering) #4

These are setting in the elasticsearch output in winlogbeat. If you send to logstash, then you can not use those settings. You will have to do filtering/routin in logstash. Check out index setting in logstash elasticsearch output

(Dv Thiyanesh) #5

But There is no these kind of settings in logstash index?

What can i do?

(Steffen Siering) #6

See index setting. You can reuse any field available in your event or in @metadata (fields in @metadata will not be send to Elasticsearch).

(Dv Thiyanesh) #7

What I cannot get it? could you explain little bit?

(Steffen Siering) #8

In Logstash you can configure the index to be:

output {
  elasticsearch {
    ...
    index => "%{[@metadata][index]}-%{+yyyy.MM.dd}"
  }
}

In this example the @metadata.index field will be used as base name. Using conditionals in filter, you can set this field to whatever you need.

(system) closed #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.