如何在logstash.conf文件中創建多個索引？

Question

我用下面的代碼段來創建在logstash.conf索引

output { 
    stdout {codec => rubydebug} 
    elasticsearch { 
     host => "localhost" 
     protocol => "http" 
     index => "trial_indexer" 
    } 
} 

要創建另一個索引i一般與另一種在上面的代碼替換索引名。有沒有在同一個文件中創建多個索引的方法？我是新來的ELK。

Answer 1

您可以根據其中一個字段的值使用索引名稱中的模式。這裏我們使用type字段的值，以命名索引：

output { 
    stdout {codec => rubydebug} 
    elasticsearch { 
     host => "localhost" 
     protocol => "http" 
     index => "%{type}_indexer" 
    } 
} 

您也可以使用多個elasticsearch輸出到同一ES主機或不同的ES主機：

output { 
    stdout {codec => rubydebug} 
    elasticsearch { 
     host => "localhost" 
     protocol => "http" 
     index => "trial_indexer" 
    } 
    elasticsearch { 
     host => "localhost" 
     protocol => "http" 
     index => "movie_indexer" 
    } 
} 

或者也許你想給你的路線文件，基於一些變量不同的指標：

output { 
    stdout {codec => rubydebug} 
    if [type] == "trial" { 
     elasticsearch { 
      host => "localhost" 
      protocol => "http" 
      index => "trial_indexer" 
     } 
    } else { 
     elasticsearch { 
      host => "localhost" 
      protocol => "http" 
      index => "movie_indexer" 
     } 
    } 
} 

UPDATE

的語法已經改變一點點Logstash 2和5：

output { 
    stdout {codec => rubydebug} 
    if [type] == "trial" { 
     elasticsearch { 
      hosts => "localhost:9200" 
      index => "trial_indexer" 
     } 
    } else { 
     elasticsearch { 
      hosts => "localhost:9200" 
      index => "movie_indexer" 
     } 
    } 
}