Index and id tag to my log stash config

Hello, Exerts

I have a logstash config with works well. Just need your advice to auto creat index and id to the output file.

Config:

input {
file {
path => "/tmp/sam"
}
}

output {
file {
path => "/tmp/sam_output"
}
}

current Output :
mmoses@dev-platops-eng02:/opt/logstash/bin$ echo "Hello World" > /tmp/sam; tail -f /tmp/sam_output
{"message":"Hello World","@version":"1","@timestamp":"2017-09-15T18:25:51.082Z","host":"dev-platops-eng02.kendall.corp","path":"/tmp/sam"}
{"message":"Hello World","@version":"1","@timestamp":"2017-09-15T18:25:51.721Z","host":"dev-platops-eng02.kendall","path":"/tmp/sam"}

desired output
mmoses@dev-platops-eng02:/opt/logstash/bin$ echo "Hello World" > /tmp/sam; tail -f /tmp/sam_output
{"index":{"_index":"helloworld","_type":"date","_id":0}}
{"message":"Hello World","@version":"1","@timestamp":"2017-09-15T18:25:51.082Z","host":"dev-platops-eng02.kendall.corp","path":"/tmp/sam"}
{"index":{"_index":"helloworld","_type":"date","_id":0}}
{"message":"Hello World","@version":"1","@timestamp":"2017-09-15T18:25:51.721Z","host":"dev-platops-eng02.kendall.corp","path":"/tmp/sam"}

Use a mutate filter and its add_field option to add the fields you want. See https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references for more on the syntax you should use for nested fields.

Thanks, Magnus!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.