Massive filtering in modules? Or in Logstash


I followed the discussion around - a pull request to get the icinga module of Filebeat compatible to ECS. There were some changes that are bit confusing to me, which I try to clarify in this thread:

What I wanted to ask here is what you think would be the best to proceed: We started implementing a complete Logstash pipeline with all filters for Icinga 2 logs. I'm sure it's way too much filtering to be implemented in the local icinga module of Filebeat but should we think about getting it into an igest pipeline for Elasticsearch? The different syntax makes me hesitant because it was already quite a load of work to get the Logstash pipeline to the point where it is now.

What do you think?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.