logstash elastic search output configuration based on inputs

Question

Is there any way I can use logstash configuration file to scale output accordingly with different types/indexes ?

For eg.,

output {
 elasticsearch {
    hosts => ["localhost:9200"]
    index => "index_resources"
    if(%{some_field_id}==kb){
         document_type => "document_type"
         document_id => "%{some_id}"
    }
   else {
        document_type => "other_document_type"
        document_id => "%{some_other_id}"
   }
}

Kulasangar · Accepted Answer · 2016-12-07 09:20:43Z

1

Yes you could route your documents to multiple indexes within your logstash itself. Output could look something like this:

output {  
    stdout {codec => rubydebug}
    if %{some_field_id} == "kb" {  <---- insert your condition here
        elasticsearch {  
            host => "localhost"  
            protocol => "http"  
            index => "index1"
            document_type => "document_type"
            document_id => "%{some_id}"   
        }
    } else {
        elasticsearch {  
            host => "localhost"  
            protocol => "http"  
            index => "index2"
            document_type => "other_document_type"
            document_id => "%{some_other_id}"   
        }
    }
}

This thread might help you as well.

answered Dec 7, 2016 at 9:20

Kulasangar

9,5326 gold badges65 silver badges97 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

logstash elastic search output configuration based on inputs

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related