Problem creating dynamic index from filename (filebeat)

Elastic Stack Logstash
1

Hello,

i am trying to create index name same as filename from source but it doesn't seem to work, here's my logstash config file :

   input {
      beats{
     port=> 5044
     }
   }

     filter {

     grok {
          match => ["source",".*\\%{GREEDYDATA:app_name}"]
       }
   }

     output {

       stdout {
         codec => rubydebug
          }


         elasticsearch {
          hosts => ["localhost:9200"]
      index => "%{app_name}"
       }
   }
2

What do you see on stdout and what makes you think it is not working?

3

the index name i get is exactly %{app_name}

4

OK, so there is no [app_name] field on the event.

5

there is actually! and i also tried many fields that 100% exist but still it doesn't work

6

here's the pattern test:

pattern

7

I've found the solution, i have used [log][file][path] instead of source and i used mutate to transform it to lowercase, now it's creating indexes based on the source filename.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.