I have a VM. There are 2 similiar apps (docker apps) inside it, staging and development. They use 1 filebeat to push log to logstash. On these log, I have field
container.labels.com_docker_compose_project. I want to create 2 index. with condition:
First index, will collect log if there is value start with
Second index, will collect log if there is value start with
Is it possible? If possible how?
I want to try something like this:
if "^aeon-piccolo" in [container.labels.com_docker_compose_project]
But I think it didnt work.