Logstash - send to different elasticsearch dependent on var

[joshg (Josh)]

I have 2 elasticsearch environments. 1 for dev and 1 for prod.

I want log stash to send to the correct environment dependent on an environment variable

This is what my current output config looks like

output {
  stdout {
    codec => dots {}
  }

  IF {environment} == "live"  
  elasticsearch {
    hosts => ["live-env-url:9200"]
    user => "username"
    password => "password"
    index => "logs-%{environment}-%{application}[%{+YYYY-MM-dd}]"
  }
  ELSE 
  elasticsearch {
    hosts => ["dev-env-url:9200"]
    user => "username"
    password => "password"
    index => "logs-%{environment}-%{application}[%{+YYYY-MM-dd}]"
  }
}

Help, please and thank you

[magnusbaeck (Magnus Bäck)]

if [environment] == "live"  {
  elasticsearch {
    hosts => ["live-env-url:9200"]
    user => "username"
    password => "password"
    index => "logs-%{environment}-%{application}[%{+YYYY-MM-dd}]"
  }
} else {
  elasticsearch {
    hosts => ["dev-env-url:9200"]
    user => "username"
    password => "password"
    index => "logs-%{environment}-%{application}[%{+YYYY-MM-dd}]"
  }
}