In logstash i am trying to forward all of the logs in elasticsearch into logstash and then to a third party. What is the correct configuration for the index query?
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
elasticsearch {
hosts => "localhost:9200"
ssl_enabled => true
ssl_verification_mode => none
api_key => "XXxxXXxxXX"
index => ["logs-cisco_ios.log-default", "logs-windows.powershell-default"]
query => '{ "query": { "query_string": { "query": "*" } } }'
size => 10
schedule => "*/1 * * * *"
scroll => "1m"
docinfo => true
docinfo_target => "[@metadata][doc]"
}
}
output {
tcp {
host => "A.B.C.D"
port => XYZ
codec => json_lines
}
}