I am trying to find the best way to set the index name based on the prospector that picked up the log entry. In general, I would like everything to default to
index, then use
indices for the specific changes as outlined in https://www.elastic.co/guide/en/beats/filebeat/5.5/elasticsearch-output.html#_indices.
I would have thought that using the
when configuration element of
indices was the right way to do this, but I can't find documentation on it anywhere, just a few examples on that page. What I imagine doing is adding a tag as a part of the prospector, then searching the tag in the
Will this work? Does documentation for
when exist yet?