Hi guys, I am trying to capture login and logout events in programs such as TeamViewer and AnyDesk, installed in a Windows virtual machine. Then I send them to my Logstash server via the same Filebeat node, here is the input, filter and output configuration file. The output I'm using is shared for …

[image] nach_usal: output { elasticsearch { hosts => ["192.168.153.7:9200"] manage_template => false if [type] == "beats_programas" { if "teamviewer" in [tags] { index => "syslog.soc.beats_teamviewer" } else { index => "syslog.soc.beats_anydesk" …

Discuss the Elastic Stack

Help with logstash output

Elastic Stack Logstash

Badger July 27, 2023, 9:12pm 4

You cannot have a conditional within the configuration of an output. See this post.

1 Like

Topic		Replies	Views
Expected one of # Logstash	8	1102	May 2, 2017
LS - elasticsearch output conditionals Logstash	3	1099	July 6, 2017
Winlogbeat to Logstash = Config file help required Logstash	1	443	October 15, 2018
Logstash elasticsearch output plugin filtering Logstash	8	830	May 7, 2018
Logstash output conditions doesn't works Logstash	2	1413	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Help with logstash output

Related topics