diff --git a/templates/logstash/config/logstash/pipeline/filebeat.conf.j2 b/templates/logstash/config/logstash/pipeline/filebeat.conf.j2 index 1049e0c..7a3e917 100644 --- a/templates/logstash/config/logstash/pipeline/filebeat.conf.j2 +++ b/templates/logstash/config/logstash/pipeline/filebeat.conf.j2 @@ -53,7 +53,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[fields][hostname]}-authlog-%{+YYYY.MM.dd}" + index => "%{[fields][hostname]}-authlog-%{+YYYY.MM}" manage_template => false } @@ -65,7 +65,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "uncategorized-authlog-%{+YYYY.MM.dd}" + index => "uncategorized-authlog-%{+YYYY.MM}" manage_template => false } @@ -77,7 +77,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[fields][hostname]}-syslog-%{+YYYY.MM.dd}" + index => "%{[fields][hostname]}-syslog-%{+YYYY.MM}" manage_template => false } @@ -89,7 +89,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "uncategorized-syslog-%{+YYYY.MM.dd}" + index => "uncategorized-syslog-%{+YYYY.MM}" manage_template => false } @@ -101,7 +101,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[fields][hostname]}-postgresql-%{+YYYY.MM.dd}" + index => "%{[fields][hostname]}-postgresql-%{+YYYY.MM}" manage_template => false } @@ -113,7 +113,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[fields][hostname]}-mysql-%{+YYYY.MM.dd}" + index => "%{[fields][hostname]}-mysql-%{+YYYY.MM}" manage_template => false } @@ -126,7 +126,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[fields][hostname]}-harbor-%{[fields][harbor-component]}-%{+YYYY.MM.dd}" + index => "%{[fields][hostname]}-harbor-%{[fields][harbor-component]}-%{+YYYY.MM}" manage_template => false } @@ -138,7 +138,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][deployment][name]}-%{+YYYY.MM.dd}" + index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][deployment][name]}-%{+YYYY.MM}" manage_template => false } @@ -150,7 +150,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][daemonset][name]}-%{+YYYY.MM.dd}" + index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][daemonset][name]}-%{+YYYY.MM}" manage_template => false } @@ -162,7 +162,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][statefulset][name]}-%{+YYYY.MM.dd}" + index => "%{[stage]}-%{[kubernetes][namespace]}-%{[kubernetes][statefulset][name]}-%{+YYYY.MM}" manage_template => false } @@ -174,7 +174,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "uncategorized-kubernetes-%{[kubernetes][namespace]}-%{+YYYY.MM.dd}" + index => "uncategorized-kubernetes-%{[kubernetes][namespace]}-%{+YYYY.MM}" manage_template => false } @@ -186,7 +186,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "%{[container][name]}-%{+YYYY.MM.dd}" + index => "%{[container][name]}-%{+YYYY.MM}" manage_template => false } @@ -198,7 +198,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "uncategorized-%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" + index => "uncategorized-%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM}" manage_template => false } @@ -210,7 +210,7 @@ output { user => "{{ elastic_admin_username }}" password => "{{ elastic_admin_password }}" - index => "uncategorized-%{+YYYY.MM.dd}" + index => "uncategorized-%{+YYYY.MM}" manage_template => false }