Syntax for index redirection (in module 'output')?


(ethr bunny) #1

In the 'output' section of my beats.conf I want to send different types of input to different indexes. The 'filter' section lets me pick and choose like so: "if [fileset][module] =~ " --> is there a way to do this in the 'output' section?

Presently I use this format:
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"

How would I pick off entries from [fileset][module] =~ "auditd" and send those to their own index separate from other filebeat entries?


(Magnus B├Ąck) #2

is there a way to do this in the 'output' section?

Yes. It works in exactly the same way as in the filter section.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.