Hi team, Would like to ask for your help with regards on having an if else condition on Filebeat’s output to elasticsearch. Would like to check if fields.age ==10 the output to be one array of hosts else other array of hosts If fields.age ==10: Output.elasticsearch: Hosts:[“http:es01:9200”]…

Filebeat does not support sending to multiple outputs, you can find more info about this at Support multiple outputs of the same type (like two independent Logstash clusters) · Issue #1035 · elastic/beats · GitHub . You can define conditional-like ES indexes in Logstash which is described at Elastic…

If/Else condition for Output to Elasticsearch

Elastic Stack Beats

ChrsMark (Chris Mark) June 14, 2021, 8:29am 2

Hi @valhalla!

I'm afraid you cannot set conditions on host's level. What you can is to use conditions in index'es level (Configure the Elasticsearch output | Filebeat Reference [7.13] | Elastic).

Filebeat send logs to different port

Topic		Replies	Views
Pipelines or "if else" conditions for output Logstash	13	15785	April 26, 2018
Filebeat store under different index per host? Beats filebeat	6	1655	June 8, 2017
If Else in Logstash Logstash	11	22492	March 7, 2017
Clarification on if/else behavior in output Logstash	3	381	October 21, 2019
Logstash output configuration for beat Logstash	3	615	July 6, 2017

If/Else condition for Output to Elasticsearch

Related topics