Answer the question
In order to leave comments, you need to log in
Logstash: how to create one index per host?
Hello! They come from Filebeat, then Logstash passes them to Elasticsearch. Now a new index is created every day:
input {
beats {
port => 5044
}
}
filter {
date {
match => [ "logdate", "ISO8601" ]
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
# document_type => "%{[@metadata][type]}"
# document_type => "doc"
document_type = > "log"
}
}
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question