Logstash index based on filter

user_16339871 0
Viewed 68

Hi I am reading stdout and filtering both apache and application logs using logstash as below

input {
 beats {
 port => 5044
 }
}
filter {
  grok {
   match => { "message" => "%{COMBINEDAPACHELOG}"}
  }
  json {
   source => "message"
  }
}
output { elasticsearch { hosts => "http://elasticsearch-master:9200"} }

These logs are reaching the elastic search properly, however how can i give a seperate index in es for apache and application log in logstash output here?

elastic-stack elk logstash
1 Answers

You can separate those in input plugin by using "type" . you can try the below Note: Assuming that the log is apache logs

input {
 beats {
 port => 5044
#assuming that your log is apache
 type => "apache" 
 }
}


filter {
  grok {
   match => { "message" => "%{COMBINEDAPACHELOG}"}
  }
  json {
   source => "message"
  }
}



output {  
    stdout {codec => rubydebug}


    if [type] == "apache" {
        elasticsearch {  
            hosts => "http://elasticsearch-master:9200"  
            index => "apache_index"   
        }
    } 

    else {
        elasticsearch {  
            hosts => "http://elasticsearch-master:9200"  
            index => "application_index"   
        }
    }
}

Keep Posted !!! Thanks !!!

user_191191580
Related