Skip to content

[streams] Confirm setting the target index to "logs" routes data to streams #45505

@cmacknz

Description

@cmacknz

Confirm that setting the target index to "logs" in each possible location will automatically route data to the new streams experience. Document any specific steps that need to be taken when generating API keys for use in this mode, if any.

  • The target index can be set in each input via the index parameter:
    #### `index` [_index_9]
    If present, this formatted string overrides the index for events from this input (for elasticsearch outputs), or sets the `raw_index` field of the event’s metadata (for other outputs). This string can only refer to the agent name and version and the event timestamp; for access to dynamic fields, use `output.elasticsearch.index` or a processor.
    Example value: `"%{[agent.name]}-myindex-%{+yyyy.MM.dd}"` might expand to `"filebeat-myindex-2019.11.01"`.
  • The target index can be set in the Elasticsearch output via the index parameter:
    output.elasticsearch:
    hosts: ["http://localhost:9200"]
    index: "%{[fields.log_type]}-%{[agent.version]}-%{+yyyy.MM.dd}" <1>
  • Using an add_fields processor to set the index name in @metadata:
    processors:
    - add_fields:
    target: '@metadata'
    fields:
    op_type: "index"

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions