Filter the data sent by filebeat

Elastic Stack Logstash
1

Hello Everyone,

I have a small problem with filebeat and logstash.

On my logstash machine I receive data from two different servers (filebeat). The problem is that I don't want to apply the same filters to the 2 servers because they send different logs.

So my question is how to make logstash know what log it receives and what filter apply to it.

Thank you a lot.

2

On the Filebeat side set different types for each type of log (use the document_type option), then use conditionals on the Logstash side to choose which filters to use for each type.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html

1 Like
3

Thank you very much it's work !

I have another question now: how do I send the data in different indexes ? (elasticsearch)

4

You can use conditionals in the output section too.

5

It works. Thank you for your help @magnusbaeck !

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.