Filebeat: Select index based on prospector

Elastic Stack Beats
2

For simplicity I'd use format strings:

filebeat.prospectors:
- ...
  fields.class: "nginx"
- ...
  fields.class: "apache"

output.elasticsearch:
  index: '%{[fields.class]-%{+yyyy.MM.dd}'

You can use indices with when clause. If no when clause matches, the index setting will be applied.

Documentation on when-clause is available in the 'Conditions' documentation: https://www.elastic.co/guide/en/beats/filebeat/current/configuration-processors.html#conditions

It's always when.<condition>:.

2 Likes