On Fri, May 12, 2017 at 12:50:16AM -0400, Scot wrote: > destination d_es_beats { > elasticsearch2( > disk-buffer( [...] > index("winlogbeat-${YEAR}.${MONTH}.${DAY}") just a sidenote here: don't forget to add time-zone(UTC) to your elasticsearch destination, otherwise you'll have surprises in Kibana