Conditional index + pipeline in output?

Elastic Stack Beats
1

I noticed here that you can do conditional selection of indices in the output. I was trying to carry that over to also use a specific pipeline when sending to that index as well.

Here's what I have;

output.elasticsearch:
  hosts: ["http://192.168.1.199:9206"]
  index: "filebeat-%{[beat.version]}-%{+yyyy.MM}"
  indices:
  - index: "filebeat-pihole-%{[beat.version]}-%{+yyyy.MM}"
      pipeline: pihole-logging
        when.contains:
          message: "dnsmasq"

I am getting this Exiting: error loading config file: yaml: line 156: mapping values are not allowed in this context and was wondering if what I am trying to do will even work :slight_smile:

2

It seems your indentation is wrong, though I don't get the exact same error as you do.

Try with this:

output.elasticsearch:
  hosts: ["http://192.168.1.199:9206"]
  index: "filebeat-%{[beat.version]}-%{+yyyy.MM}"
  indices:
  - index: "filebeat-pihole-%{[beat.version]}-%{+yyyy.MM}"
    pipeline: pihole-logging
    when.contains:
      message: "dnsmasq"
1 Like
3

Ugh, I wondered if it was that but couldn't figure out the correct hierarchy :frowning:

Now that it doesn't seem impossible, I'll try and report back!

4

Just a heads up that this works an absolute treat, thanks for the help! :smiley:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.