Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
~~~~
filter {
mutate {
add_field => { "[@metadata][target_index]" => "logstash-%{+YYYY.MM.dd}" }
}
if [program] == "jube" {
mutate {
update => { "[@metadata][target_index]" => "longterm-%{+YYYY.Q}" }
}
}
}
~~~~
and
~~~~
output {
if "_grokparsefailure" not in [tags] {
elasticsearch {
workers => 2
template_overwrite => true
document_type => "%{@type}"
flush_size => 5000
hosts => [ "127.0.0.1:9200" ]
index => "%{[@metadata][target_index]}"
}
}
}
~~~~
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.