Hello ES users, i have filebeat instance sending one source log to ES via logstash pipeline. Now, i want to add another file on filebeat input list and use the same logstash pipeline but write to a different new index. Can someone please share the ideal approach on how to differentiate these 2 files and at what level? Is it filter level on LS pipeline or is it at output level? Thanks.
Use either conditionals, or sprintf as mentioned in Accessing event data and fields | Logstash Reference [8.11] | Elastic
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.