Input filter only metricbeat data

Elastic Stack Beats
1

Is there a way to configure input only metricbeat events in the logstash.conf file?
Generally, inputs will include all beat events like input { beats { port => 5044 } }. But i am looking to input ONLY metricbeat events so that my filter will have specific condition to only metricsets. The index is not getting created if type is checked in the output field. Please suggest the right way to achieve.

I need similar to below. This logstash.conf file should only take metricbeat data and NOT filebeat or heartbeat data

input {
  metricbeat { *  }
}

filter { }

output {
  if [@metadata][beat] and [@metadata][beat] = "metricsets" {  # or if [type] = "metricsets" {
    elasticsearch {
      hosts => ["elasticserch.server:9200"]
      manage_template => false
      index => "metricbeat-index-%{+YYYY.MM.dd}"
    }
  }
}
2

In the plugins-input-beats, id field is used like below. How to setup plugin id for metricbeat if this approach solves metricbeat input.

input {
  beats {
    id => "my_plugin_id"
  }
}

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-id

3

There is only a generic beats input and not one for each beat. What do you expect to happen to all the non filebeat data?

Looking at your first approach I would expect it to work (except the input part). Anything that didn't work here?

4

I was looking for input that should take only the metricbeat data as input. I though of using id plugin for this purpose. It seems there is no such option. Is that right?

5

The beat input will accept all the data. The question is what happens with it then. You can use filters to for example only filter out the metricbeat data and drop all filebeat data.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.