I want to get the two indexes from two input data in the one logstash config file. (One is from tshark file and the other one is filebeat so each data are different.)
tshark data is changed to json file for input and filebeat is using suricata module.
So my concept was
input {
file {
path => "/path/tshark.json"
type => "tshark"
}
beats {
port => 5044
type => "filebeat"
}
}
filter {
if [type] == "tshark" {
~~~
}
else if [type] == "filebeat" {
~~~
}
}
output{
if [type] == "tshark" {
elasticsearch{
host => ["address:port"]
index=> "tshark"
}
}
else if [type] == "filebeat" {
elasticsearch{
host => ["address:port"]
index=> "filebeat"
}
}
}
It doesn't work for me. It didn't make any index. I used [tags] instead of [type], in that case the filtering was not applied each of index.
So I tried multiple pipeline too, but the result was that two indexes were created with the same data but with different names.
This is wrong, the conditional needs to be outside the output plugin:
output {
if [type] == "tshark" {
elasticsearch { your elasticsearch output }
} else if [type] == "filebeat" {
elasticsearch { your elasticsearch output }
}
}
But the best approach is to use different pipelines with pipelines.yml, one pipeline you would have the input and output for tshark and the other the input and output for filebeat.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.