Syntax for index redirection (in module 'output')?

Elastic Stack Logstash
1

In the 'output' section of my beats.conf I want to send different types of input to different indexes. The 'filter' section lets me pick and choose like so: "if [fileset][module] =~ " --> is there a way to do this in the 'output' section?

Presently I use this format:
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"

How would I pick off entries from [fileset][module] =~ "auditd" and send those to their own index separate from other filebeat entries?

2

is there a way to do this in the 'output' section?

Yes. It works in exactly the same way as in the filter section.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.