Sorry to ask this, I have searched long for an answer but not found anything.
My winlogbeat, packetbeat and metricbeat are all sent to logstash on 5044. I want logstash to output them to dedicated indexes. I am using the following config for logstash but everything goes to the last index. Please tell me what have I got wrong, thanks!
this is similar to what I do. I only use if statements, no else if or else. I have a fall back value in case my version of %{[@metadata][target_index]}
Thanks A_B, I have removed the filters and used the beats @metadata to create the index names. Much cleaner config and the result I was looking for, Cheers!
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.