Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save isweluiz/8a9914d129ea3d87f0f4a39b2bec5fa6 to your computer and use it in GitHub Desktop.
Save isweluiz/8a9914d129ea3d87f0f4a39b2bec5fa6 to your computer and use it in GitHub Desktop.
Multiple Elasticsearch outputs in logstash
#http://pastebin.com/xGt6vv9R from yardenbar
output {
if [type] == "postfix" {
elasticsearch {
host => [ "ES_HOSTNAME" ]
protocol => "transport"
cluster => "elasticsearch"
index => "postfix-%{+YYYY.MM.dd}"
manage_template => true
template_overwrite => true
template => "/etc/logstash/templates.d/postfix.json"
template_name => "postfix"
}
}
else if [type] in ["nginx", "nginx_error"] {
elasticsearch {
host => [ "ES_HOSTNAME" ]
protocol => "transport"
cluster => "elasticsearch"
index => "nginx-%{+YYYY.MM.dd}"
manage_template => true
template_overwrite => true
template => "/etc/logstash/templates.d/nginx.json"
template_name => "nginx"
}
}
else if [type] == "rails" {
elasticsearch {
host => [ "ES_HOSTNAME" ]
protocol => "transport"
cluster => "elasticsearch"
index => "rails-%{+YYYY.MM.dd}"
manage_template => true
template_overwrite => true
template => "/etc/logstash/templates.d/rails.json"
template_name => "rails"
}
}
else if [type] == "webpagetest" {
elasticsearch {
host => [ "ES_HOSTNAME" ]
protocol => "transport"
cluster => "elasticsearch"
index => "webpagetest-global"
manage_template => true
template_overwrite => true
template => "/etc/logstash/templates.d/webpagetest.json"
template_name => "webpagetest"
}
}
else if [type] == "push-notification" {
elasticsearch {
host => [ "ES_HOSTNAME" ]
protocol => "transport"
cluster => "elasticsearch"
index => "push-notification-%{+YYYY.MM.dd}"
manage_template => true
template_overwrite => true
template => "/etc/logstash/templates.d/push_notification.json"
template_name => "push_notification"
}
}
else if [type] == "fastly" {
elasticsearch {
host => [ "ES_HOSTNAME" ]
protocol => "transport"
cluster => "elasticsearch"
index => "fastly-%{+YYYY.MM.dd}"
manage_template => true
template_overwrite => true
template => "/etc/logstash/templates.d/fastly.json"
template_name => "fastly"
}
}
else {
file {
path => "/var/log/logstash/unknown_messages.log"
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment