Rename Index Prefix for Data Sent to Elasticsearch

Currently, we have Logstash_Format enabled for the fluentbit settings with no prefix set so the indexes for data show "logstash-YYY.MM.DD" even though we are not utilizing Logstash directly.

Fluentbit configuration allows for setting "Logstash_Prefix" to update this name:

https://docs.fluentbit.io/manual/pipeline/outputs/elasticsearch

If it's in logstash format, does it matter it came from FluentBit?

It does not, mostly updating name because we've gotten multiple comments that having the index prefix as "logstash" is confusing.

@ryan.j.garcia https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/375 ^-- This documentation may be sufficient to remove the confusion.

Otherwise if you still think it's worth renaming I'd suggest making it generic like logs vs logstash or fluentbit

Thanks Chris, I think that is good enough, we have enough documentation and knowledge out there now that there should be much less confusion.

mentioned in issue elasticsearch-kibana#9 (closed)

closed