I am having great difficulty parsing my Filebeat input into separate Indices dependant on some custom fields. My IIS server has filebeat installed and the filebeat.yml looks like this: filebeat.inputs: enabled: true fields: {log_type: iis} My beats output on my logstash server looks like this…

Hi Luke, There are two things that need to be considered. [image] luke14: fields: {log_type: iis} I am not sure if this is the correct syntax to add a field. I believe it is: fields: log_type: "iis" If both the configurations are same, please let me know. I am not quite sure. Secondly,…

Thanks for the reply. I got this to work but only from a property on the log, I used the pre-defined if [fileset][module] == "iis" { .... The filebeat.yml was reading the config okay with that syntax. I noticed there wasn't any [fields][log_type] in elastic search so therefore my filebeat.yml con…

I have tried to stay away from if so I solved a similar situations like this Filebeat --- - type: log paths: - /var/log/foo.log encoding: plain fields: log_prefix: bar log_idx: logs fields_under_root: false In Logstash filter section # Adding @metadata needed for index shardi…

[image] luke14: I suppose my question is what is the best approach to tag or label filebeat inputs from within the filebeat.yml? What is the best practice Both the approaches are perfectly fine. I don't think there is any such best practice associated with this. However, using the if stateme…

Discuss the Elastic Stack

Logstash Conditional Indexes

Elastic Stack Logstash

Topic		Replies	Views
How to configure conditional input-output from Filebeats Logstash	10	5015	August 7, 2018
Use filebeat added field for logstash conditions Logstash	2	374	July 23, 2019
Migration from old ELK to Elastic Cloud Logstash	3	343	February 17, 2022
Create Multiple Indexes from filebeat Logstash	2	1620	September 2, 2021
Filebeat store under different index per host? Beats filebeat	5	1707	May 11, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash Conditional Indexes

Related topics