Filebeat how to predefine index name from filebeat.yml file.
Imagine a situation where you want to create an index with predefine name
but it should be parameterized with created date month .
In such situations use below filebeat.yml file.
filebeat.inputs:
— type: log
paths:
— C:\FREESOFT\myfilebeatlogs\*
setup.ilm.enabled: false
setup.template.overwrite: true
output.elasticsearch:
hosts: [“localhost:9200”]
index: “foo-%{+yyyy.MM}”
setup.template:
name: “foo”
pattern: “foo-*”
enabled: false
foo is the index name prefix that get appended at the end with created year and month. .So here my filename is foo and log files locations are mentioned in paths.
hosts: [“localhost:9200”] is the elasticsearch hostname.
To run the .yml file.go inside C:\FREESOFT\filebeat-7.9.3-windows-x86_64\filebeat-7.9.3-windows-x86_64 via command line
.\filebeat.exe -c filebeat.yml
.\ is like relative path run from here .
To verify it’s started Go to Elasticsearch index paten creation and then create an index pattern.
