leandrojmp
2020-11-29 03:20:01
You can use a conditional output in your filebeat.yml based on a string present in your message.
Something like:
output.elasticsearch:
hosts: ["http://localhost:9200"]
indices:
- index: "request-info-%{+yyyy.MM.dd}"
when.contains:
message: "request comes"
If your message contains the string request comes it will be sent to the index request-info-2020.11.28 for example, if it does not contains, it will be sent to the default index.
You can read more about the options to the elasticsearch output in this documentation link
Oh great, thank you! I knew
indexandwhen, but did not think that it can be conditionally set like this :)