Update filebeat-k8s.yml

duplocloud · Oct 3, 2024 · f318f53 · f318f53
1 parent ebf9292
commit f318f53
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/diagnostics/opensearch/filebeat/conf/filebeat-k8s.yml b/diagnostics/opensearch/filebeat/conf/filebeat-k8s.yml
@@ -61,5 +61,7 @@ output.elasticsearch:
     - index: "filebeat-%{[agent.version]}-%{[tenant.name]}-%{+yyyy.MM.dd}"
       when.equals:
         tenantLevelIndex: "yes"
+    - index: "filebeat-%{[agent.version]}-kami-%{+yyyy.MM.dd}"    # New index for kami prefixed fields
+      when.has_fields: ["kami.log_type"]
   bulk_max_size: '${BULK_MAX_SIZE:50}'
   worker: '${WORKER_COUNT:1}'