Goodmorning everyone,
I need to know if there is a possibility to set elasticsearch as input (also as an output), parsing all the logs I had previously parsed with logstash.
For example:
I have parsed all my akamai logs with a logstash configuration. Now I need to reparse the same logs file changing index. For now I've configured my configuration file this way:
input {
elasticsearch {
hosts => ["http://192.168.1.3:9200/"]
user => "elastic"
password => "changeme"
index => "akamai_logs*"
query => '{ "query": { "match_all": {} } }'
size => 500
scroll => "5m"
docinfo => true
}
}
output {
elasticsearch {
hosts => ["http://192.168.1.3:9200/"]
user => "elastic"
password => "changeme"
index => "newindex"
}
stdout { codec => rubydebug }
}
What am I doing wrong?
Thanks for the support!