I have multiple logs I want to output to a index with the computer name and filename if its from filebeat and with computername if anything else. Not sure on the best way to accomplish below is my attempt however not sure how to grab the filename and computer name. I setup a custom pattern for teamviewer_id and info.
# Beats -> Logstash -> Elasticsearch pipeline.
input {
beats {
port => 5044
host => "10.10.10.10"
}
}
filter {
grok { patterns_dir => ["./patterns"]
if [LOGFILENAME] == "Teamviewer11_Logfile.log" {
match => { "message" =>
[
"%{DATESTAMP:logtime}%{SPACE}%{INFO:id1}%{SPACE}%{INFO:id2}%{SPACE}%{GREEDYDATA:messagestart}%{SPACE}(?<teamviewerid>%{TEAMVIEWER_ID})%{GREEDYDATA:messageend}",
"%{DATESTAMP:logtime}%{SPACE}%{INFO:id1}%{SPACE}%{INFO:id2}%{GREEDYDATA:message}"
]
}
}
else if [LOGFILENAME] == "Connections_incoming.txt" {
match => { "message" =>
[
"%{DATESTAMP:logtime}%{GREEDYDATA:message}"
]
}
}
date { match => [ "[@metadata][timestamp]", "YYYY/MM/dd HH:mm:ss.SSS" ]
}
}
}
output {
if %{[@metadata][beat]} == "filebeat" {
elasticsearch {
hosts => ["http://10.10.10.10:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-COMPUTERNAME-LOGFILENAME"
#user => "elastic"
#password => "changeme"
}
}
else {
elasticsearch {
hosts => ["http://10.10.10.10:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-COMPUTERNAME"
#user => "elastic"
#password => "changeme"
}
}
}