Question about multiple conf files

Elastic Stack Logstash
1

Hello,

I'm having some troubles with my conf file (more than 300 lines and growing) so I decide to split it on severals files and looking for information about that I read that is not possible to duplicate the input option for each file.

So my approach is to have one input.conf and severals conf files for each filter and output.

Example:
input.conf

input {
    beats {
        port => 5000
    }
}

fileA.conf

filter {
    if [type] == "A" {
        DO STUFF
    } 
}

output {
     f [type] == "A" {
             elasticsearch {
                    hosts => ["elasticsearch:9200"]
                    index => "A-%{+YYYY.MM.dd}"
            }
     } 
}

fileB.conf

filter {
    if [type] == "B" {
        DO STUFF
    } 
}

output {
     f [type] == "B" {
             elasticsearch {
                    hosts => ["elasticsearch:9200"]
                    index => "B-%{+YYYY.MM.dd}"
            }
     } 
}

There is any problem to duplicate the output as happens with the input? is my approach correct?

Thanks for the help!

Extra info:
logstash and beats 5.X

2

This looks fine.

3

Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.