我的日志有两个数据源。一个是beat,一个是kafka,我想基于源代码创建es索引。if kafka->在索引名前面加上kafka,if beat在索引名前面加上beat。
input {
beats {
port => 9300
}
}
input {
kafka {
bootstrap_servers => "localhost:9092"
topics => ["my-topic"]
codec => json
}
}
output {
# if kafka
elasticsearch {
hosts => "http://localhost:9200"
user => "elastic"
password => "password"
index => "[kafka-topic]-my-index"
}
# else if beat
elasticsearch {
hosts => "http://localhost:9200"
user => "elastic"
password => "password"
index => "[filebeat]-my-index"
}
}
1条答案
按热度按时间ugmeyewa1#
在输入中添加标签并使用它们过滤输出。