Multiple templates in one logstash.conf

Elastic Stack Elasticsearch
1

Hi,

I am trying to use multiple templates for the indexes in the output section in logstash.conf, but it is always ignoring one of the templates.
Sample conf:
output {
if [type] == "log1" {
elasticsearch { hosts => ["localhost:9200"]
index => "sample1-%{+MM.YYYY}"
template => "/root/logstash-2.2.2/log1.json"
manage_template => true
template_overwrite => true
}
}
if [type] == "log2" {
elasticsearch { hosts => ["localhost:9200"]
index => "sample2-%{+MM.YYYY}"
template => "/root/logstash-2.2.2/log2.json"
manage_template => true
template_overwrite => true
}
}
}

Also suggest me a good example for this kind of configuration.
Thanks in advance.

2

Both outputs are storing the templates under the same name ("logstash"). Use the elasticsearch output's template_name option to pick a unique template name for each output (e.g. "log1" and "log2" to match the index template filenames).

1 Like
3

Thank you so much and this worked.