Split up indices based on? tags?

Elastic Stack Logstash
2

This seems to work, which also makes sure my Kibana index parttern winlogbeat-* still works

output {
  if "radius" in [tags] {
    elasticsearch {
      hosts => "elasticsearchIP:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-radius-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  } else {
    elasticsearch {
      hosts => "elasticsearchIP:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  }
}

How do you other guys separate indices?

1 Like