Hello, I am collecting logs and trying to output the logs to multiple indexes. Can I define a field for each index? My Logstash output configuration is as follows. input: ip, name, url, msg output { if "agg" in [tags] { elasticsearch { hosts => ["localhost:9200"] …

I see three possibilities: use Elasticsearch mapping parameter to exclude the fields from the documents for this the fields must be defined in the mapping of the index but with enabled: false and than also must be excluded from the _source field with "_source": { "excludes": [ <list of …

jmkim January 28, 2019, 2:41am 3

Thank you, Shaoranlaos!
I really appreciate your answers.

Topic		Replies	Views
Logstash Elasticsearch Output with specific fields to index Logstash	4	992	August 23, 2018
Outputting to several elastcisearch indeces Logstash	2	847	July 6, 2017
Single input and multiple output Logstash	3	3041	April 3, 2018
Send parts of a message to different Elasticsearch indices from a single Logstash instance Logstash	5	399	December 13, 2022
Multiple outputs with different formats Logstash	4	433	September 23, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to define a field when pushing the same document to multiple indexes?

Related topics