Logstash single input and multiple output

Question

I have configured logstash to get input from one filebeat port. Filebeat configured with two different paths. is it possible to display logs to two different index?

Logstash input part:

input{
beats 
   {
     type => "stack"
     port => 5044
   }

Filebeat input part :

 prospectors:

  paths:
    - E://stack/**/*.txt
    - E://test/**/*.txt

Now i need to display "stack" in one index and "test" in other index. How to configure logstash output part?

Val · Accepted Answer · 2016-03-15 09:18:21Z

1

What you can do is to use the knowledge of the type property in order to decide in which index to store the log being processed.

So your elasticsearch output could simply look like this, i.e. depending on the type value, the selected index will be different.

output {
 elasticsearch {
   hosts => ["localhost:9200"]
   manage_template => false
   index => "%{type}"
 }
}

answered Mar 15, 2016 at 9:18

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

BornToCode Over a year ago

The elastic guys don't encourage the use of type attribute and in addition it won't apply if you already have type field in your source (it doesn't override). So it's better to use tags or add_field instead.

Val Over a year ago

@BornToCode that blog article is more recent than my answer, but yeah...

Collectives™ on Stack Overflow

Logstash single input and multiple output

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related