Impossible to create a second index

Elastic Stack Logstash
5

Hi, thanks

Ok, I explain that differently. I have two entry, in the input file. Yes. I have One entry in the output. Yeap. So, yes, "Syslog" and "cron" will be redirected in the same canal, the one I configured in the output. It shouldn't be a problem, I have a customer which have a similar configuration. That works well, apparently.

If that work for him, that should work for me. In first view, of course :). But, the problem, in my case, is that doesn't work, precisely. That turn in loop. As you can see in the logs I added in this thread :

Loop exited. Forcing reload

Anyway, I understand what you mean... I do not see the second index, because precisely I do not have a second output. Noted.

Ok... I can try to add another entry in my file "output". Something like that :

root@Big-Monster:/etc/logstash/conf.d# cat 99_output.conf
output {
  elasticsearch {
    id => "TEST-output-Syslog"
    hosts => [ "127.0.0.1" ]
    index => "syslog-%{+YYYY.MM.dd}"
    }

  elasticsearch {
    id => "TEST-output-Cron"
    hosts => [ "127.0.0.1" ]
    index => "Cron-%{+YYYY.MM.dd}"
    }
}

But how to make in sort the logs configured to the input "cron" be redirected to the output "cron" and not the output "syslog" ? Maybe we must have the same ID in both configuration input, ouput for cron, or something like that ? Maybe there is some subtility I missed.

Or I must, necessary, use multiple pipelines ? it is another question I asked here : How to link input contain to output contain

Apologies, I am a newbe on ELK. I am precisely working to learn to use it. There is a lot of documentations, but it is not easy for me, stranger, to understand all. Even if I do my best :slight_smile:

Best regards,
Chris