Hi guys, I am trying to capture login and logout events in programs such as TeamViewer and AnyDesk, installed in a Windows virtual machine. Then I send them to my Logstash server via the same Filebeat node, here is the input, filter and output configuration file. The output I'm using is shared for …

[image] nach_usal: output { elasticsearch { hosts => ["192.168.153.7:9200"] manage_template => false if [type] == "beats_programas" { if "teamviewer" in [tags] { index => "syslog.soc.beats_teamviewer" } else { index => "syslog.soc.beats_anydesk" …

Discuss the Elastic Stack

Help with logstash output

Elastic Stack Logstash

Badger July 27, 2023, 9:12pm 4

You cannot have a conditional within the configuration of an output. See this post.

1 Like

Topic		Replies	Views
Logstash output not working and not throwing an error Beats packetbeat	3	440	October 27, 2020
Can't recieve filebeat logs via Logstash Logstash	16	2966	May 31, 2019
Logstash active exited using filebeat input Logstash	2	1876	July 6, 2017
Logstash input with filtered output Logstash	9	547	April 9, 2021
Logstash always output input event type as log Logstash	4	1483	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Help with logstash output

Related topics