I'm trying to setup with one filebeat instance the apache module and the Tomcat module because we have done customisation in the pipeline and would like to have two separate indices I try the following
configuration:
output.elasticsearch:
hosts: ["node1:9200" , "node2:9200" , "node3:9200"]
api_key: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
protocol: "https"
indices:
- index: "httpd_dev-%{+yyyy.MM}"
when.equals:
event.category: "web"
- index: "tomcat_dev-%{+yyyy.MM}"
when.equals:
event.category: "tomcat"
pipelines:
- pipeline: "filebeat-7.13.2-apache-*"
when.equals:
event.category: "httpd"
- pipeline: "filebeat-7.13.2-tomcat-*"
when.equals:
event.category: "tomcat"
But the result seem to be that all the event are sent to the tomcat pipeline and the tomcat index , when I setup the apache module alone the module worked fine.