How should I configure the logstash output so that the data gets into a sub index.
E.g:
index => "/food/%{food_type}"
where food_type is a field I have created in filter {}
There is no such thing as a "sub index". Index names can't contain slashes.
The proper nomenclature I was looking for is type
The elasticsearch output uses the type field as the document type. You can override that with the elasticsearch output's document_type option.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.