I want to create multiple indices using Logstash configuration into ES. From my understanding, it is easy to use type in file-input if we have multiple inputs. Then, create one index per one type.
But, I do not have multiple input files here. I have only one input-file. I just want to parse results differently. That means, for one index, I want to apply lot of filters(date,split,ruby..); for the other index, I do not want any filters applied. Finally put these indices into same elasticsearch output cluster.
How to achieve this?
Below is config file which describes what I want to achieve.
input {
file {
codec => json
path => "/path/to/json"
start_position => "beginning"
}
}
filter {
#### **apply these filters only for index2**
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "index1"
}
elasticsearch {
hosts => ["localhost:9200"]
index => "index2"
}
stdout { codec => rubydebug }
}