Can we send data from different url's into different index in elastic search using one single logstash config file

Viewed 18

Using http poller as input plugin and elastic search as output plugin can we send data from different urls into different indicies in elasticsearch using one single logstash config file.

1 Answers

Yes you can do it using if conditions in the output section:

input {
    http_poller {
        ...
        add_tag => "source1"
    }
    http_poller {
        ...
        add_tag => "source2"
    }
}
filter {
    ...
}
output {
    if "source1" in [tags] {
         elasticsearch {
             ...
             index => "index1"
         }
    }
    else if "source2" in [tags] {
         elasticsearch {
             ...
             index => "index2"
         }
    }
}
Related