Outputting into different indices based on source

Elastic Stack Logstash
1

I want to create different indices based on the source of the data. I currently have:

input {
beats {
    port => 5044
}}

filter {
    if ([source] =~ "examiner.log") {
        json {
        source => "message"	
        add_tag => ["examiner"]
        }
    } else if ([source] =~ "temp.log") {
        mutate {
            add_tag => ["TEMP"]
        }
    }
}

output {
    if ([source] =~ "examiner.log") {
        elasticsearch {
        hosts => "localhost:9200"
        index => "examiner"
        }
    } else {
         elasticsearch {
        hosts => "localhost:9200"
        index => "data"
        }
    }
}

Only the data index gets created, I'm not sure why the first conditional is skipped in the output.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.