Skip to content

Instantly share code, notes, and snippets.

@Zhomart
Forked from thisismitch/filebeat-index-template.json
Last active February 20, 2018 14:07
Show Gist options
  • Save Zhomart/e8a86d1cf052bf913d3e65d891eece54 to your computer and use it in GitHub Desktop.
Save Zhomart/e8a86d1cf052bf913d3e65d891eece54 to your computer and use it in GitHub Desktop.
Fix for elastic 6.0. Run: `curl -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@filebeat-index-template.json -H "Content-Type: application/json"`
{
"mappings": {
"_default_": {
"dynamic_templates": [
{
"template1": {
"mapping": {
"doc_values": true,
"ignore_above": 1024,
"index": "not_analyzed",
"type": "{dynamic_type}"
},
"match": "*"
}
}
],
"properties": {
"@timestamp": {
"type": "date",
"copy_to": "_all"
},
"message": {
"type": "text",
"index": true,
"copy_to": "_all"
},
"offset": {
"type": "long",
"doc_values": "true",
"copy_to": "_all"
},
"geoip" : {
"type" : "object",
"dynamic": true,
"properties" : {
"location" : { "type" : "geo_point" }
}
}
}
}
},
"settings": {
"index.refresh_interval": "5s"
},
"template": "filebeat-*"
}
filebeat:
prospectors:
-
paths:
- /var/log/secure
- /var/log/messages
# - /var/log/*.log
input_type: log
document_type: syslog
registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["elk_server_private_ip:5044"]
bulk_max_size: 1024
tls:
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
shipper:
logging:
files:
rotateeverybytes: 10485760 # = 10MB
filebeat:
prospectors:
-
paths:
- /var/log/auth.log
- /var/log/syslog
# - /var/log/*.log
input_type: log
document_type: syslog
registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["elk_server_private_ip:5044"]
bulk_max_size: 1024
tls:
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
shipper:
logging:
files:
rotateeverybytes: 10485760 # = 10MB
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment