Hi, thanks
Ok, I explain that differently. I have two entry, in the input file. Yes. I have One entry in the output. Yeap. So, yes, "Syslog" and "cron" will be redirected in the same canal, the one I configured in the output. It shouldn't be a problem, I have a customer which have a similar configuration. That works well, apparently.
If that work for him, that should work for me. In first view, of course :). But, the problem, in my case, is that doesn't work, precisely. That turn in loop. As you can see in the logs I added in this thread :
Loop exited. Forcing reload
Anyway, I understand what you mean... I do not see the second index, because precisely I do not have a second output. Noted.
Ok... I can try to add another entry in my file "output". Something like that :
root@Big-Monster:/etc/logstash/conf.d# cat 99_output.conf
output {
elasticsearch {
id => "TEST-output-Syslog"
hosts => [ "127.0.0.1" ]
index => "syslog-%{+YYYY.MM.dd}"
}
elasticsearch {
id => "TEST-output-Cron"
hosts => [ "127.0.0.1" ]
index => "Cron-%{+YYYY.MM.dd}"
}
}
But how to make in sort the logs configured to the input "cron" be redirected to the output "cron" and not the output "syslog" ? Maybe we must have the same ID in both configuration input, ouput for cron, or something like that ? Maybe there is some subtility I missed.
Or I must, necessary, use multiple pipelines ? it is another question I asked here : How to link input contain to output contain
Apologies, I am a newbe on ELK. I am precisely working to learn to use it. There is a lot of documentations, but it is not easy for me, stranger, to understand all. Even if I do my best
Best regards,
Chris