How Can I Change The Index Names From Logstash-*

3 years ago logit.io

Summary: This is a summary of an article originally published by the source. Read the full original article here →

October 12th 2020Getting Started 2 min read Tip: To edit your Logstash filters for any Stack choose View Stack Settings > Logstash Pipelines from your Dashboard. If your sending your data via an Elastic beat such as Filebeat your condition should be: mutate { replace => {"[@metadata][beat]" => “YOURINDEXNAME” }}

if[FIELD] == "CONDITION"{ mutate { add_field => {"[@metadata][beat]" => "YOURINDEXNAME"} }}

So if you wanted to have your IIS logs in their own index you could add: if[type] == "iis"{ mutate { add_field => {"[@metadata][beat]" => "iis"} }}

DevOps Articles