How to let Functionbeat write to multiple indices

Elastic Stack Beats
1

Hello
Is there a way to let Functionbeat write to multiple indices?
I have seen that it can write to only one of many indices according to defined rules.
Example:
output.elasticsearch:
indices:
- index: "index-first"
when.contains:
message: "field1"
- index: "index-second"
when.contains:
message: "field2"

The above will write to index-first if field1 exists and to index-second if field2 exists.
What I want is to write tow copies of same data to both indices, can that be done from Functionbeat side?

2

As all Beats, Functionbeat can write to multiple indices as well as seen in the docs: Configure the Elasticsearch output | Functionbeat Reference [7.10] | Elastic

However, after you change the configuration of the Beat, you have to redeploy the function. Thus, the new options can be picked by the Beat.

Also, if you have problems with a specific configuration, please share it and format it using </>.

3

Hello Kvch, thank you for your reply
As per docs and the things I tried.
"Functionbeat uses the first matching rule in the array."
so Functionbeat will write to only the first index that matches the rule.
What I want is that Functionbeat write to two indices, not just the first one that matches the rule.
Hope my need is clear now.
Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.