Customized logstash ip for each filebeat prospectors

[mahsa_b]

Hi
I was wondering if it's possible to have multiple prospectors to read from different directory and based on that, send the events to a specific logstash.
ex: I want to read from router-log and send it to :5044
read from switch log and send it to :5045
and so on.

the thing is I don't want to send the events to all of the logstashes but the exact specific one.

[andrewkroh]

It not possible to do event routing in Beats. The best you could do is apply fields or tags to the events on the beats side. Then do the routing in a LS instance based on those tags or just use the source value to do routing.

[mahsa_b]

Thanks for the answer . could you elaborate a little about " just use the source value to do routing."

[andrewkroh]

I was thinking in LS you could use the source field which contains the file's full path to conditionally route the event to a particular output.

output {
  if [source] =~ /some_regex/ {
    elasticsearch { ... }
  } else if [source] =~ /some_other_regex/ {
    elasticsearch { ... }
  }
}