K
K
KoiGva2020-01-27 18:04:38
logstash
KoiGva, 2020-01-27 18:04:38

How to set output index name for elasticsearch in Logstash?

Hello!

There is a Filebeat config in which the field is defined log_type:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/some/storage/logs/laravel*.log
  fields:
    log_type: laravel_log

How to pick up this field in the output config of Logstash in order to use it in the name of the elasticsearch index?
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
It is necessary to replace %{[@metadata][beat]}with this field, but %{[log_type]}does not work.

Also, is it correct to use this field in Logstash filters like this:
if [log_type] == "laravel_log" { ...some actions... }
?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question