Logstash from multiple beats server

Elastic Stack Logstash
1

hello every one,
i am using logstash to receive data from multiple server using winlogbeats over the port 5044
I want to create an index for each server based on the server name
can some one provide me with the logstash filter and output template to use

2

I found the solution, to whom interested here is my config

filter {
   mutate {
               remove_field => ["[event][original]"]
       }
    if [host][hostname] == "the host name in the log " {
        mutate { add_field => { "[@metadata][indexPrefix]" => "hostname" } }
    }
      }
output{
    stdout { }
    if [@metadata][indexPrefix] {
      elasticsearch {
  .................     
      index =>  "%{[@metadata][indexPrefix]}-%{+YYYY.MM.dd}"
   .............
                      }
        }
      }
1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.