HI....
I remember that I was unable to do what I initially wnated
I was unable to change the default behaviour and I end up using logstash-service-%{} output in order for it to work, like this excerpt of output config
} else if "php5mail" in [tags] {
elasticsearch {
host => "172.16.0.25"
cluster => "MyCluster"
index => "logstash-php5mail-%{+YYYY.MM.dd}"
}
} else if "centovacastmatch" in [tags] {
elasticsearch {
host => "172.16.0.26"
cluster => "Mycluster"
index => "logstash-centovacast-%{+YYYY.MM.dd}"
}
} else if "centovaerrormatch" in [tags] {
elasticsearch {
host => "172.16.0.27"
cluster => "Mycluster"
index => "logstash-centovaerror-%{+YYYY.MM.dd}"
}
Note the index => "logstash-SERVICE-%{+YYYY.MM.dd}" syntax, indicating that I'm sticking with default filtering / index setup and using it as expected.
I'm using but Elasticsearch 1.5 in production, so it may be old.
Remember that my way of work is based on early tagging!
To avoid contamination you have to make an adequate TAGGING PLANNING.
I tag log lines as soon as they are ingested from log lines at input moment filtering (this is what I mean as the 'service tag' concept / approach).... THERE is where I decide the final index "family" they will end up....SO:
lines read from /var/log/apache2 get an "apache" tag added at input filter time, lines read from /var/mail get a "postfix" tag added at input filter time, and so on....
Afterwards, I add other tags to allow future filtering... tags such as "server1", "cluster3", "customerX", "hosting", etc (remember you can add as much tags as you want ) that may differ from server to server allow future data filteryng / analysing / grouping... but the fact is every server reading an apache log line will mark it with an "apache" tag! this is the log line, distinguishing, 'service tag'!
Of course, the log line is analyzed using adequate filters (with adequate grok patterns) that are selected based (again) on the 'service tag'! , exploding the log line data into current data fields...
Finally, at output filter time, and again using the 'service tag', I send logs containing "apache" to an logstash-apacheXXXXXX index.
There is NO CONATMINATION: only apache lines have "apache" tag... postfix lines do not have "apache" tag, but "postfix" tag instead, so there is uniqueness factor that prevents it to happen.
It is simple and works perfect to me...
)...