如何检查来源是否Kafka或殴打在logstash?

au9on6nz  于 2021-06-04  发布在  Kafka
关注(0)|答案(1)|浏览(379)

我的日志有两个数据源。一个是beat,一个是kafka,我想基于源代码创建es索引。if kafka->在索引名前面加上kafka,if beat在索引名前面加上beat。

input {
  beats {
    port => 9300
  }
}

input {
  kafka {
    bootstrap_servers => "localhost:9092"
    topics => ["my-topic"]
    codec => json
  }
}

output {
    # if kafka
      elasticsearch {
        hosts => "http://localhost:9200"
        user => "elastic"
        password => "password"
        index  => "[kafka-topic]-my-index"
     }
    # else if beat
    elasticsearch {
        hosts => "http://localhost:9200"
        user => "elastic"
        password => "password"
        index  => "[filebeat]-my-index"
     }
}
ugmeyewa

ugmeyewa1#

在输入中添加标签并使用它们过滤输出。

input {
  beats {
    port => 9300
    tags => ["beats"]
  }
}

input {
  kafka {
    bootstrap_servers => "localhost:9092"
    topics => ["my-topic"]
    codec => json
    tags => ["kafka"]
  }
}

output {
    if "beats" in [tags] { 
        output for beats 
    }
    if "kafka" in [tags] { 
        output for kafka 
    }
}

相关问题