How to Differentiate Logs from a Host

Elastic Stack Logstash
1

Usecase:

I have a test service instance on a host where a log-stash agent is configured. This logs are stashed to a common elastic server. Now this will be test service instance will be cleaned up and another test service instance will be installed and log-stash agent is reconfigured against the same elastic server. Now my question is whether there is a way to say that the logs from same host shown in elastic server are from specific test instance(with unique id).

2

You could add a tag or other field to the events originating on the test instance. A mutate filter would do.

3

Thanks. Can you please quote me some examples.

4

The mutate filter's documentation contains examples.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.