如何在logstash.conf文件中創建多個索引？

Question

我使用以下代碼在logstash.conf中創建索引

output {  
    stdout {codec => rubydebug}  
    elasticsearch {  
        host => "localhost"  
        protocol => "http"  
        index => "trial_indexer"   
    }
} 

要創建另一個索引，我通常會在上面的代碼中用另一個索引替換索引名稱。 有沒有辦法在同一個文件中創建多個索引？ 我是ELK的新手。

Answer 1

您可以根據其中一個字段的值在索引名稱中使用模式。 這里我們使用type字段的值來命名索引：

output {  
    stdout {codec => rubydebug}  
    elasticsearch {  
        host => "localhost"  
        protocol => "http"  
        index => "%{type}_indexer"   
    }
} 

您還可以將多個elasticsearch輸出用於同一ES主機或不同的ES主機：

output {  
    stdout {codec => rubydebug}  
    elasticsearch {  
        host => "localhost"  
        protocol => "http"  
        index => "trial_indexer"   
    }
    elasticsearch {  
        host => "localhost"  
        protocol => "http"  
        index => "movie_indexer"   
    }
} 

或者您可能希望根據某個變量將文檔路由到不同的索引：

output {  
    stdout {codec => rubydebug}
    if [type] == "trial" {
        elasticsearch {  
            host => "localhost"  
            protocol => "http"  
            index => "trial_indexer"   
        }
    } else {
        elasticsearch {  
            host => "localhost"  
            protocol => "http"  
            index => "movie_indexer"   
        }
    }
} 

UPDATE

Logstash 2和5中的語法有所改變：

output {  
    stdout {codec => rubydebug}
    if [type] == "trial" {
        elasticsearch {  
            hosts => "localhost:9200"  
            index => "trial_indexer"   
        }
    } else {
        elasticsearch {  
            hosts => "localhost:9200"  
            index => "movie_indexer"   
        }
    }
}