Is there a way to add "userdata" to an input-definition?

I'd like the data read from a particular input to be sent to a different index in ElasticSearch. I tried the following, but logstash refuses it for syntax error -- setting @metadata in an input-definition is, apparently, not allowed:

input {
	unix {
          path => "/tmp/logstash-cdn1.sock"
          [@metadata][esindex] => "cdn1"
	}
}
...
output {
    elasticsearch {
      hosts => ["localhost:9200"]
      index => "logstash-%{[@metadata][esindex]}-%{+YYYY.MM.dd}"
    }
}

I know, I can set type, but we are already using that for something else. I can also set it in filter, but that will happen for each event slowing things down a bit. Can it be set once per input somehow?

Would adding a tag at the input help ?

input {
unix {
path => "/tmp/logstash-cdn1.sock"
tags => [ "cdn1" ]
}
}

No, because a tag being there is only a boolean -- I'd like the data to store the actual value, a string...

You can certainly set any field values in the input (metadata or not) but you must use the correct syntax for adding fields:

input {
  unix {
    ...
    add_field => {
      "[@metadata][esindex]" => "cdn1"
    }
  }
}
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.