Output to different index based on field

Elastic Stack Logstash
12

In the end, I gave up trying to use logstash and used this method of achieving what I desired:


output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"
  indices:
    - index: "filebeat-netflow"
      when.equals:
        event.module: "netflow"
    - index: "filebeat-threatintel"
      when.equals:
        event.module: "threatintel"
1 Like