From 11d3ed36b72846dd2772f164cd9d8ea50af79a45 Mon Sep 17 00:00:00 2001 From: weslambert Date: Mon, 11 Jul 2022 17:22:09 -0400 Subject: [PATCH] Specify outputs for Elasticsearch and Kibana for Eval and Import Mode Add outputs for Elasticsearch and Kibana for Eval/Import Mode, since Logstash is not used in Eval Mode or Import Mode. Otherwise, logs from these inputs end up in a filebeat-prefixed index. --- salt/filebeat/etc/filebeat.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml index 176007bae..75b45d4e6 100644 --- a/salt/filebeat/etc/filebeat.yml +++ b/salt/filebeat/etc/filebeat.yml @@ -449,6 +449,12 @@ output.elasticsearch: - index: "so-logscan" when.contains: module: "logscan" + - index: "so-elasticsearch-%{+YYYY.MM.dd}" + when.contains: + event.module: "elasticsearch" + - index: "so-kibana-%{+YYYY.MM.dd}" + when.contains: + event.module: "kibana" setup.template.enabled: false {%- else %}