# About the Logstash data output

**URL:** https://discuss.elastic.co/t/about-the-logstash-data-output/107857
**Category:** Logstash
**Created:** [November 16, 2017, 5:13am UTC](https://discuss.elastic.co/t/about-the-logstash-data-output/107857 "2017-11-16T05:13:03Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![lightlevin](https://avatars.discourse-cdn.com/v4/letter/l/f17d59/32.png) [@lightlevin](https://discuss.elastic.co/u/lightlevin)
#### Post date: [November 16, 2017, 5:13am UTC](https://discuss.elastic.co/t/about-the-logstash-data-output/107857/1 "2017-11-16T05:13:03Z")

</div>

I try to use metricbeat + logstash + influxdb for data collection,  
Logstash conf:

```
influxdb {
  host => ["xxx.xxx.xxx.xxx"]
  db => "metricbeat"
  codec => json
  data_points => {
    "platform" => "%{platform}"
    "hostname" => "%{[beat][hostname]}"
    "system.core.id" => "%{[system][core][id]}"
    "system.cpu.user.pct" => "%{[system][cpu][user][pct]}"
  }

```

influxdb:

> SELECT \* FROM logstash ORDER BY time DESC LIMIT 10  
> name: logstash  
> time beat beat.hostname beats\_input\_raw\_event environnement hostname ip\_address platform system.core.id system.core.user.pct system.cpu.user.pct

* * *

1510806295000000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}  
1510806294987000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}  
1510806294838000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}  
1510806294835000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}  
1510806294833000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}  
1510806294832000000 rh6.5 BT 0 %{[system][cpu][user][pct]}  
1510806294829000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}  
1510806294812000000 rh6.5 BT %{[system][core][id]} 0.015

I hope:

1510806295000000000 rh6.5 BT  
1510806294987000000 rh6.5 BT  
1510806294838000000 rh6.5 BT  
1510806294835000000 rh6.5 BT  
1510806294833000000 rh6.5 BT  
1510806294832000000 rh6.5 BT 0  
1510806294829000000 rh6.5 BT  
1510806294812000000 rh6.5 BT 0.015

What should I do?

---

<div class="post-metadata">

### Author: ![lightlevin](https://avatars.discourse-cdn.com/v4/letter/l/f17d59/32.png) [@lightlevin](https://discuss.elastic.co/u/lightlevin)
#### Post date: [November 16, 2017, 9:00am UTC](https://discuss.elastic.co/t/about-the-logstash-data-output/107857/2 "2017-11-16T09:00:06Z")

</div>

```
if [metricset][name] == "cpu" {
  influxdb {
    host => ["192.168.100.13"]
    db => "metricbeat"
    codec => json
    data_points => {
        "platform" => "%{platform}"
        "hostname" => "%{[beat][hostname]}"
        "system.cpu.user.pct" => "%{[system][cpu][user][pct]}"
    }
  }
} else if [metricset][name] == "memory" {
    influxdb {
      host => ["192.168.100.13"]
      db => "metricbeat"
      codec => json
      data_points => {
        "platform" => "%{platform}"
        "hostname" => "%{[beat][hostname]}"
        "system.memory.used.pct" => "%{[system][memory][used][pct]}"
        }
      }
    }

```

}  
}

The above method to solve my problem, but good writing complicated, do not know to have a more simple way

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 14, 2017, 9:05am UTC](https://discuss.elastic.co/t/about-the-logstash-data-output/107857/3 "2017-12-14T09:05:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.