Elasticsearch index based on source field

Elastic Stack Logstash
1

Hi! I would like to know if I could output to a different elasticsearch index based on my logs source field? In the sources I have unique identifiers and I would like to make indexes with these identifiers.

2

Yes, just reference the field name in the elasticsearch output's index option.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references

Also:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.