Customized logstash ip for each filebeat prospectors

I was thinking in LS you could use the source field which contains the file's full path to conditionally route the event to a particular output.

output {
  if [source] =~ /some_regex/ {
    elasticsearch { ... }
  } else if [source] =~ /some_other_regex/ {
    elasticsearch { ... }
  }
}
1 Like