How we can correlate current event value with stored index value from elasticsearch

Elastic Stack Logstash
1

Hi Folks,

We are collecting real-time feeds from multiple sources using logstash. however, we stored some of our identification in elasticsearch index manually. Now, we are looking for filter plugin in logstash who can give us access to run query from logstash filter end and append matched results into current event.

If anyone knows which plugin and how we an perform lookup into elasticsearch. kindly help us.

Regards,
Yash M.

2

You can use the ElasticSearch filter plugin, but keep in mind that -depending on your index size or query complexity- it might slow down your pipeline a bit.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.