Contains condition on multiple index - Filebeat

Elastic Stack Beats
1

Hello,
I'm using filebeat to collect information from log but I need to slip them on different Indexes. To do this I'm using

indices:
    - index: "filebeat-%{[agent.version]}-api-%{+yyyy.MM.dd}"
      when.contains:
        message: "webapi"

I need to know if it is possible to check the condition when message contains host="myhost.site.com" (including quots)

I'm trying but it does not works may some help please
thanks for your time
best regards

2

I'm not convinced if there is such condition. It would be nice if you can figure out a different way of determining traffic from that host. Maybe different log files?

3

Yes there are different log file, but I did not find a way to filter on filename

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.