Customized logstash ip for each filebeat prospectors

I was wondering if it's possible to have multiple prospectors to read from different directory and based on that, send the events to a specific logstash.
ex: I want to read from router-log and send it to :5044
read from switch log and send it to :5045
and so on.

the thing is I don't want to send the events to all of the logstashes but the exact specific one.

It not possible to do event routing in Beats. The best you could do is apply fields or tags to the events on the beats side. Then do the routing in a LS instance based on those tags or just use the source value to do routing.

1 Like

Thanks for the answer . could you elaborate a little about " just use the source value to do routing."

I was thinking in LS you could use the source field which contains the file's full path to conditionally route the event to a particular output.

output {
  if [source] =~ /some_regex/ {
    elasticsearch { ... }
  } else if [source] =~ /some_other_regex/ {
    elasticsearch { ... }
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.