Multiple file setting in input in logstash conf

Elastic Stack Logstash
1

my ELK version 6.7. i want to add multiple files in logstash conf file and use it conditinally. i have this conf file but it is not working.

input {
  file {
    type => "back"
    path => "E:/xampp/htdocs/project/hq/log/logs_dev.json"
    start_position => "beginning"
    sincedb_path => "NUL"
    codec => "json"
  }
  file {
    type => "api"
    path => "E:/xampp/htdocs/project/api/log/logs_dev.json"
    start_position => "beginning"
    sincedb_path => "NUL"
    codec => "json"
  }
}

filter
{ 

}

output {
  stdout { codec => rubydebug }
  if [type] == "back" {
    elasticsearch {
      hosts => ["http://127.0.0.1:9200/"] 
      index => "project_back_18"
    }
  }
  if [type] == "api" {
    elasticsearch {
      hosts => ["http://127.0.0.1:9200/"] 
      index => "project_api_18"
    }
  }
}
2

I would expect that to work. Does the rubydebug output look right? What do you get in elasticsearch.

3

thank you! if use rubydebug output look right ,yea,rubydebug output is ok, but output elasticsearch only read first line.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.