Hi
I have a logstash chain: logstashA output is logstashB input, whose output is logstashC input...
What it's better?
Setting target value like (on each logstash step):
mutate{
add_field => { "[@metadata][_index]" => "myindexonstepB" }
}
or replacing the field:
mutate{
replace => { "[index]" => "myindexonstepB" }
}
Thanks