How to output to multiple indexes straight from filebeat.yml

Elastic Stack Beats
1

how to change logstash conf file to filebeats, multiple input to multiple indexes straight to elastic

logstash.conf

input {
file {
path => "/var/loginmgr/portal.txt"
type => "loginmgr"
start_position => "beginning"
}

file {
    path => "/var/manager/fcp_log.txt"
    type => "manager"
    start_position => "beginning"
}

file {
    path => "/var/log/cfgserver.log"
    type => "cfgserver"
    start_position => "beginning"
}

}
output {

if [type] == "loginmgr" {
    elasticsearch {
        hosts => ["192.168.228.232:9200"]
        index => "loginmgr-%{+YYYY.MM.dd}"
    }
}

if [type] == "manager" {
    elasticsearch {
        hosts => ["192.168.228.232:9200"]
        index => "manager-%{+YYYY.MM.dd}"
    }
}

if [type] == "cfgserver" {
    elasticsearch {
        hosts => ["192.168.228.232:9200"]
        index => "cfgserver-%{+YYYY.MM.dd}"
    }
}

}

2

I don't believe event routing is possible yet in Filebeat output.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.