Output Beats

[Arethusa]

Hello,

This is my architecture:

For Windows, I have this logstash configuration:

input {
  beats {
    port => 5000
    tags => ["windows"]

  }
 }

output {
  if "windows" in [tags] {
  gelf {
  host => "192.168.1.206"
  port => 12201
  }
 }
}

That works, but I want to try to use beats output, but I don’t find the good syntax.

If anyone can help me.

Thank you.

[Arethusa]

On my test I try this output:

output {
  if "windows" in [tags] {
  beats {
  host => "192.168.1.206"
  port => 12201
  }
 }
}

But that not works.