mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
fix for keeping daily index
This commit is contained in:
2
docker/elk/logstash/dist/logstash.conf
vendored
2
docker/elk/logstash/dist/logstash.conf
vendored
@ -505,6 +505,8 @@ if "_grokparsefailure" in [tags] { drop {} }
|
||||
output {
|
||||
elasticsearch {
|
||||
hosts => ["elasticsearch:9200"]
|
||||
# With ILM in place we need to set the daily index manually, if not => FUBAR
|
||||
index => "logstash-%{+YYYY.MM.dd}"
|
||||
# document_type => "doc"
|
||||
}
|
||||
|
||||
|
Reference in New Issue
Block a user