Hi and thanks.
I have over 18 'if else' statements in my input and output files.
I would like to keep them as they are if at all possible (not have to break each 'if else' into seperate files.
Any pointers on how to best replace the 'types' with tags? I did try this but no go...
} else if [tag] == "rsyslog-log" {
elasticsearch {
hosts => ["els03","els04"]
user => elastic
password => elastic
#sniffing => true
manage_template => false
index => "rsyslog-%{+YYYY.MM.dd}"
#document_type => "rsyslog-log"
}