Two questions: Why type type included for INPUT when you can't use it anywhere else? And, how do I do a conditional now, if I can't specify type? How do I tell
input {
udp {
type => "Snort"
port => 5514
}
udp {
type => "Conn"
port => 6514
}
udp {
type => "Syslog"
port => 7514
}
udp {
type => "Logon"
port => 7515
}
}
the above match with:
filter {
if [type] == "Snort" {
grok {
match => [ stuff ]
}
}
if [type] == "Conn" {
grok {
several match => [ stuff ]
}
}
if [type] == "Syslog" {
grok {
several match lines match => [ stuff ]
}
}
if [type] == "Logon" {
grok {
match => [ stuff ]
}
}
}
How do match a specific input, to a specific filter now? Thank you.
You can use type as a regular field. You just can't use type => "value" in place of conditionals. Logstash still uses type to set the Elasticsearch document _type on output.
Again, you can use type. The examples you've provided are completely valid and usable.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.