Sending output to different indices depending on conditions

Elastic Stack Beats
1

Hi,
I try to write logs via filebeat to different indices depending on a field in the logs. But I'm not sure, how the rule setting when is working.
Is it correct, that if the first when condition is fullfilled the second and further will not be checked ?

For better explanation - the goal is to write to different indices depending on the field kubernetes.namespace. If the field kubernetes.namespace contains test then the log should be written to index k8s-%{[kubernetes.namespace]}-%{[loglevel]} otherwise to k8s-%{[kubernetes.namespace]}.

Does the following configuration work as described above or will logs be written to both indices - k8s-%{[kubernetes.namespace]}-%{[loglevel]} and k8s-%{[kubernetes.namespace]} - if namespace is containing test ?

output.elasticsearch:
  hosts: ['${ELASTICSEARCH_HOSTS}']
  index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"
  indices:
    - index: "k8s-%{[kubernetes.namespace]}-%{[loglevel]}"
      when.regexp:
        kubernetes.namespace: "test"
    - index: "k8s-%{[kubernetes.namespace]}"
      when.regexp:     
        kubernetes.namespace: ".*"

Thnx for any help !

Best regards, Detlef

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.