Hi,
I am using ELK GA 6.3.0. I have a logstash input like;
input {
jdbc {
id => "jdbc1"
.
.
.
statement => "some sql statement"
add_field => { "logtype" => "jdbc_log_1" }
}
}
and I have multiple jdbc inputs, from different tables. The content from tables will go to their corresponding ES indices. I want to condition check to publish to elasticsearch. What I am currently doing is;
output{
if[logtype] == "jdbc_log_1"{
elasticsearch {
.
.
.
index => "jdbc_log_1-%{+YYYY-MM-dd}"
}
}
}
This works fine. But I want to do this with input id metadata field jdbc1
and avoid if[logtype] == "jdbc_log_1"{
. Is there any way to do this?
Thanks