Logstash pipeline indexing error

Hi team,

I am using ELK stack 8.12 for observability. I am collecting input data from SNMP plugin and filtering the data as per my requirement but while doing that i have multiple index for multiple events that I am collecting so at this time I am not able to index the data into the elasticsearch. I am creating a field named index with respective name as per the events but at the end that index is becoming like this

"index" => [
[0] "index1",
[1] "index2",
[2] "Index3",
[3] "index4"
like this and my output plugin is like

output {
elasticsearch {
hosts => ["https://elasticsaerch:9200"]
ssl.certificate_authorities : "/certs/cert"
index => "%{index}"
ssl => true
ilm_enabled => true
}
stdout{codec => rubydebug}
}

but in this way i am not able to index the data.

Thanks in advance.

You need to share your logstash configuration to show how you are creating the index field.

It cannot be an array, so something needs to be changed.

Thank you for the response

There has an issue in the filter part. That's why its shown that way.
Issue resolved.
thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.