Removing duplications in output block

Elastic Stack Logstash
1

Hi,

Any way of slimming output down? Duplication looks ugly. For example host, sniffing and manage_template could be made common/shared.

Thanks

output {
    if [type] == "apache-access" {
        elasticsearch {
            hosts => ["localhost:9200"]
            sniffing => true
            manage_template => false
            index => "ap-index"
        }
    } else if [type] == "symfony-dev" {
        elasticsearch {
            hosts => ["localhost:9200"]
            sniffing => true
            manage_template => false
            index => "my-hello-index"
        }
    }
}
2

As the only thing that differs is the index prefix, you can set the index prefix in a metadata parameter in the index block and then reference this in a single output as described in this post. This means that you only need one elasticsearch output irrespective of index name, which in addition to clean up the configuration also can improve performance as a batch only will result in a single, larger bulk request.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.