elk logstash中修改index

Posted 2020-10-28

可以使用命令直接定义

    input {
    udp {
        ...
        type => "foo"
    }
    file {
        ...
        type => "bar"
    }
}

output {
    if [type] == "foo" {
        elasticsearch {
            ...
            index => "foo-index"
        }
    } else {
        elasticsearch {
            ...
            index => "bar-index"
        }
    }
}