CODEWITHSUNDEEP
logstashelastic-stackfilebeat
mhyousefi
mhyousefi

Reputation: 1234

How to use the index specified in Filebeat in logstash.yml?

I am using Filebeat to send log files over to my Logstash with the following configurations:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - ${PWD}/filebeat-volume/data/*.txt

output.logstash:
  enabled: true
  hosts: ["elk:5044"]
  index: "custom-index"

setup.kibana:
  host: "localhost:5601"

and 

input {
  beats {
    port => "5044"
  }
}

output {
  elasticsearch {
    hosts => [ "localhost:9200" ]
    index => "<WHAT SHOULD GO HERE???>"
  }
}

In filebeat.yml, I am specifying an index ("custom index"). How can I set the same index in my logstash.yml to be sent to Elasticsearch?

Upvotes: 0

Views: 1029

Answers (1)

Noa
Noa

Reputation: 845

I see what you want now, you should set Logstash with below output configuration, this way it will pass the index set in filebeat to Elasticsearch.

output {
  elasticsearch {
    hosts => [ "localhost:9200" ]
    index => "%{[@metadata][beat]}"
  }
}

Point 2 in this example

Upvotes: 1

Related Questions