From a1887b5cc97be78fecb9b241265b6262dd728b6d Mon Sep 17 00:00:00 2001 From: Kevin Carter Date: Fri, 15 Jun 2018 18:12:02 -0500 Subject: [PATCH] Correct community beats index Community beats sometimes lack all of the assumed metadata that a core beat would contain by default. This change will check if a beat has the version metadata before assuming it does, which is commonly not found on community beats (journalbeat). Change-Id: I64adf5ff7c810a593b9fc2d0f306cfd4bda6632d Signed-off-by: Kevin Carter --- .../templates/99-elasticsearch-output.conf.j2 | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/elk_metrics_6x/templates/99-elasticsearch-output.conf.j2 b/elk_metrics_6x/templates/99-elasticsearch-output.conf.j2 index dd6175ae..1a27e0f8 100644 --- a/elk_metrics_6x/templates/99-elasticsearch-output.conf.j2 +++ b/elk_metrics_6x/templates/99-elasticsearch-output.conf.j2 @@ -1,8 +1,17 @@ output { - elasticsearch { - hosts => {{ elasticsearch_data_hosts | shuffle(seed=inventory_hostname) | to_json }} - sniffing => {{ (not data_node | bool) | lower }} - manage_template => {{ (data_node | bool) | lower }} - index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" + if [@metadata][version] { + elasticsearch { + hosts => {{ elasticsearch_data_hosts | shuffle(seed=inventory_hostname) | to_json }} + sniffing => {{ (not data_node | bool) | lower }} + manage_template => {{ (data_node | bool) | lower }} + index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" + } + } else { + elasticsearch { + hosts => {{ elasticsearch_data_hosts | shuffle(seed=inventory_hostname) | to_json }} + sniffing => {{ (not data_node | bool) | lower }} + manage_template => {{ (data_node | bool) | lower }} + index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" + } } }