In my filebeat enable system module and application logs

[prakash22 (prakash)]

I am sending these logs to logstash. But here both application, system logs are going to one index. But I want send to two indexes.
This is logstash pipeline.

input {
beats {
port => 5044
ssl => false
}
}

output {
elasticsearch {
hosts => "http://localhost:9200"
user => elastic
password => wU8WRmKo1pPI0CqS193d
index => "odooserverlog"
}
}

Please help me on this...

[warkolm (Mark Walkom)]

You will need to use a conditional in the output and split them based on the source Beat.

@prakash22

index => "odooserverlog"

Are you using ILM here, or is this just a single index?
If it's a single index, that is not an ideal approach as you will have to delete old data from within the index, which is inefficient.

[prakash22 (prakash)]

Yes I want to use condition in the output. Can you please suggest the logstash pipeline file.
My requirement is application logs sent to odooserverlog index
filebeat system module logs has sent to another index