Hello,
I have a syslog file that aggregate logs from multiples sources (and I cant separate the logs to different files) and I have a filebeat monitoring that single file that send to logstash.
That file has the following format:
2020-05-22T12:09:18+00:00 10.100.2.137 MESSAGE_LOG
2020-05-22T12:09:18+00:00 10.100.1.138 MESSAGE_LOG
2020-05-22T12:09:18+00:00 10.100.3.136 MESSAGE_LOG
In logstash config file I have the following filter (I wanto to parse more fields but I put GREEDYDATA for this example):
filter {
grok {
match => { message => "%{TIMESTAMP_ISO8601:timestamp_syslog} %{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:message}"
}
}
}
Now I want to send the logs to different indexes based on %{SYSLOGHOST:syslog_hostname}.
In output section can I do something like:
if [syslog_hostname] == 10.100.2.137{elasticsearch{...}}
Thank you