Multiple string match to create index in filebeat

Elastic Stack Beats
,
1

I want to create multiple index in filebeat by string in message

        - indices:
        - index: "billingproxy-%{+yyyy.MM.dd}"
          regexp:
                 message: '(billingproxy & \(squid-1\))'

    - index: "proxyauditlog-%(+yyyy.MM.dd)"
          regexp:
                 message: '(billingproxy & tag_audit_log)'

but index is not created.
I think syntax for regexp is wrong.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.