Conditional index + pipeline in output?

[warkolm (Mark Walkom)]

I noticed here that you can do conditional selection of indices in the output. I was trying to carry that over to also use a specific pipeline when sending to that index as well.

Here's what I have;

output.elasticsearch:
  hosts: ["http://192.168.1.199:9206"]
  index: "filebeat-%{[beat.version]}-%{+yyyy.MM}"
  indices:
  - index: "filebeat-pihole-%{[beat.version]}-%{+yyyy.MM}"
      pipeline: pihole-logging
        when.contains:
          message: "dnsmasq"

I am getting this Exiting: error loading config file: yaml: line 156: mapping values are not allowed in this context and was wondering if what I am trying to do will even work

[adrisr (Adrian Serrano)]

It seems your indentation is wrong, though I don't get the exact same error as you do.

Try with this:

output.elasticsearch:
  hosts: ["http://192.168.1.199:9206"]
  index: "filebeat-%{[beat.version]}-%{+yyyy.MM}"
  indices:
  - index: "filebeat-pihole-%{[beat.version]}-%{+yyyy.MM}"
    pipeline: pihole-logging
    when.contains:
      message: "dnsmasq"

[warkolm (Mark Walkom)]

@adrisr

It seems your indentation is wrong

Ugh, I wondered if it was that but couldn't figure out the correct hierarchy

Now that it doesn't seem impossible, I'll try and report back!

[warkolm (Mark Walkom)]

Just a heads up that this works an absolute treat, thanks for the help!