I'd like the data read from a particular input to be sent to a different index in ElasticSearch. I tried the following, but logstash refuses it for syntax error -- setting @metadata
in an input-definition is, apparently, not allowed:
input {
unix {
path => "/tmp/logstash-cdn1.sock"
[@metadata][esindex] => "cdn1"
}
}
...
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash-%{[@metadata][esindex]}-%{+YYYY.MM.dd}"
}
}
I know, I can set type
, but we are already using that for something else. I can also set it in filter
, but that will happen for each event slowing things down a bit. Can it be set once per input
somehow?