Logstash out put based on log.file.path

Elastic Stack Logstash
1

Hello everyone,
i have a very basic logstash configuration file.getting multiple log from filebeat.
what i want to do is having different index based on file path.this is what i have done so far for output section:

output {
if [log.file.path] == "/etc/logstash/work_test/something/something.log" {
elasticsearch {
hosts => ["localhost:9200"]
index => "something"
}
}
else {
elasticsearch {
hosts => ["localhost:9200"]
index => "somethingelse"
}
}
}

but the result is one index names something else...it seems that if section is not working but else is working.
what is wrong?

2

I expect you need [log][file][path] rather than [log.file.path]

3 Likes
3

Thanks for your reply
You mean if [log] [file] [path] == something {} ?

4

Yes, but there should not be spaces embedded in it.

5

Ok thx i will test it and let you know

6

it works.thanks alot
but actually i do not understand why it must be written like this.could you explain it?

7

If [log] is an object that contains a field called [file] then in kibana you can refer to log.file, but in logstash you have to refer to [log][file]. It just has a different syntax.

8

woooowwww..many thanks for your explanation

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.