Syntax for index redirection (in module 'output')?

In the 'output' section of my beats.conf I want to send different types of input to different indexes. The 'filter' section lets me pick and choose like so: "if [fileset][module] =~ " --> is there a way to do this in the 'output' section?

Presently I use this format:
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"

How would I pick off entries from [fileset][module] =~ "auditd" and send those to their own index separate from other filebeat entries?

is there a way to do this in the 'output' section?

Yes. It works in exactly the same way as in the filter section.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.