Elasticsearch index based on source field


(Róbert Kovács) #1

Hi! I would like to know if I could output to a different elasticsearch index based on my logs source field? In the sources I have unique identifiers and I would like to make indexes with these identifiers.


(Magnus Bäck) #2

Yes, just reference the field name in the elasticsearch output's index option.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references

Also:


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.