I have configuration like that :
tcp {
port => 5044
codec => json
}
}
filter {
if ([fields][servername] == "first") {
mutate {
replace => {
"[type]" => "first"
}
}
}
else if ([fields][servername] == "second") {
mutate {
replace => {
"[type]" => "second"
}
}
}
}
output {
elasticsearch {
hosts => "x.x.x:x"
manage_template => false
index => "%{type}-%{+YYYY.MM.dd}"
}
}
This is example configuration with two servers for tests. Below you may see the name of the returned index.