Filtering data to different indexes based on source iP

[Necus]

Hi,
How can I filter data from different IP addresses to different indexes on the same elastic search.

Sample below:

input {
udp {
port => 514
type => syslog
}
}

filter {

    }

output {
elasticsearch {
hosts => ["xxxx:9200"]
index => "abc"
}
}

[Badger]

If you want a different index for each IP, then in the output filter you can use a field reference, such as

index => "%{ip}"

However, depending on your data, that may end up with a large number of small indexes, which may cause performance problems. For most data sets this is not going to be a good approach.