As uppercase is invalid in elasticsearch indices, Beats should either provide a lowercase processor or always ensure index names are lowercased when using custom fields
Use case (filebeat):
A document:
{"HDG": 125.0, "fwot": "FOO", "date": "2018-01-31 23:00:03"}
A beat configuration:
.......
- type: log
paths:
- /var/log/myfeed/*.log
json.keys_under_root: true
......
output.elasticsearch:
hosts: ["localhost:9200"]
protocol: "http"
username: "elastic"
password: "changeme"
index: "custom-%{[fwot]}-%{+yyyy.MM}-v1"
.....
As uppercase is invalid in elasticsearch indices, Beats should either provide a lowercase processor or always ensure index names are lowercased when using custom fields
Use case (filebeat):
A document:
A beat configuration: