Hi,
I would like to set the user
of the elasticsearch output plugin dynamically based on the value of a field. Using the the syntax like %{user}
doesn't work. Is there a way to achieve what I want?
Hi,
I would like to set the user
of the elasticsearch output plugin dynamically based on the value of a field. Using the the syntax like %{user}
doesn't work. Is there a way to achieve what I want?
All events in a batch sent to an Elasticsearch output will be indexed as a single bulk request, so different events can not log in as different users. For that I believe you will need to use different output plugins. What is the rationale behind this requirement?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.