hello:
I am having some issues with my LS output conditionals for elasticsearch. I have the following below as my output filter. However when I run a '--configtest' on it, it fails...I am wondering if I have my syntax wrong, as i want to send filter output based on "tags". Also, LS started to fail to create indicies on ES...I am not sure why that started? Is that permissions on ES? I see no errors in logs
output {
if [type] == "syslog" {
elasticsearch {
hosts => [ "ceelkestb-ob-8p:9200", "ceelkesdn-ob-1p:9200", "ceelkesdn-ob-3p:9200", "ceelkesdn-ob-4p:9200", "ceelkesdn-ob-5p:9200", "ceelkesdn-ob-7p:9200" ]
index => "redhat-%{+YYYY.MM.dd}"
flush_size => 1000
workers => 4
manage_template => true
template_overwrite => true
template => "/opt/logstash/lib/logstash/outputs/elasticsearch/elasticsearch-redhat-template.json"
}
}
elseif [type] == "eventlog" {
elasticsearch {
hosts => [ "ceelkestb-ob-8p:9200", "ceelkesdn-ob-1p:9200", "ceelkesdn-ob-3p:9200", "ceelkesdn-ob-4p:9200", "ceelkesdn-ob-5p:9200", "ceelkesdn-ob-7p:9200" ]
index => "eventlog-%{+YYYY.MM.dd}"
workers => 4
manage_template => true
template_overwrite => true
template => "/opt/logstash/lib/logstash/outputs/elasticsearch/elasticsearch-eventlog-template.json"
}
}
elseif [type] == "cisco-asa" {
elasticsearch {
hosts => [ "ceelkestb-ob-8p:9200", "ceelkesdn-ob-1p:9200", "ceelkesdn-ob-3p:9200", "ceelkesdn-ob-4p:9200", "ceelkesdn-ob-5p:9200", "ceelkesdn-ob-7p:9200" ]
index => "cisco-asa-%{+YYYY.MM.dd}"
flush_size => 1000
workers => 4
manage_template => true
template_overwrite => true
template => "/opt/logstash/lib/logstash/outputs/elasticsearch/elasticsearch-cisco-asa-template.json"
}
}
else {
elasticsearch {
hosts => [ "ceelkestb-ob-8p:9200", "ceelkesdn-ob-1p:9200", "ceelkesdn-ob-3p:9200", "ceelkesdn-ob-4p:9200", "ceelkesdn-ob-5p:9200", "ceelkesdn-ob-7p:9200" ]
flush_size => 2000
workers => 1
#manage_template => true
#template => "/opt/logstash/lib/logstash/outputs/elasticsearch/elasticsearch-template.json"
}
}
}