Stdout cause syslog file to be to big

Elastic Stack Logstash
5

You can reference any field on the event in the path option of the file output, although there are a couple of restrictions.

You could use a ruby filter to add the pipeline_id and hostname to the event. I would add them inside the [@metadata] field, which you can reference in the output using %{}, but they will not be sent to the destination with the rest of the fields on the event.

Something like

ruby {
    init => 'require "socket"'
    code => '
        # Or save in @class variable in init to avoid repeated call
        event.set("[@metadata][hostname]", Socket.gethostname)

        event.set("[@metadata][pipeline_id]", execution_context.pipeline.pipeline_id)"
    '
 }

...

file {
    path => "/TheFixedBit/%{[@metadata][hostname]/%{@metadata][pipeline_id]}-%{+YYYY-MM-dd}.log"
    ...