Only use input once.
input {
beats {
port => 5044
}
cloudwatch_logs {
log_group => [ "/aws/rds/instance/trips3m-prod-master/slowquery" ]
region => "us-east-1"
type=> "rds"
}
cloudwatch_logs {
log_group => [ "/aws/rds/instance/trips3m-read-private-new/slowquery" ]
region => "us-east-1"
type=> "rds_slave"
}
}
filter {}
output {
elasticsearch {
hosts => ["http://0.0.0.0:9200"]
index => "%{[@metadata][indexname]}-%{+YYYY.MM.dd}"
}
}