Based on the [type], matched events should be stored under "iislogs" index, but it is getting stored into "logstash" index.
What am I doing wrong here ?
input
{
file
{
type => "IISLogs"
path => "C:/IISLogs/*"
}
}
output
{
if[type] == "IISLogs"
{
elasticsearch
{
index => "iislogs-%{+YYYY.MM.dd}"
hosts => ["localhost:9200"]
}
}
else
{
elasticsearch
{
index => "logstash-%{+YYYY.MM.dd}"
hosts => ["localhost:9200"]
}
}
stdout
{
codec => rubydebug
}
}