基于输入的 logstash elastic search 输出配置

Question

有什么方法可以使用 logstash 配置文件根据不同 types/indexes 相应地缩放输出？

例如，

output {
 elasticsearch {
    hosts => ["localhost:9200"]
    index => "index_resources"
    if(%{some_field_id}==kb){
         document_type => "document_type"
         document_id => "%{some_id}"
    }
   else {
        document_type => "other_document_type"
        document_id => "%{some_other_id}"
   }
}

Answer 1

是的，您可以将文档路由到 logstash 本身内的多个索引。 Output 可能看起来像这样：

output {  
    stdout {codec => rubydebug}
    if %{some_field_id} == "kb" {  <---- insert your condition here
        elasticsearch {  
            host => "localhost"  
            protocol => "http"  
            index => "index1"
            document_type => "document_type"
            document_id => "%{some_id}"   
        }
    } else {
        elasticsearch {  
            host => "localhost"  
            protocol => "http"  
            index => "index2"
            document_type => "other_document_type"
            document_id => "%{some_other_id}"   
        }
    }
}

这个 thread 也可能对您有所帮助。

基于输入的 logstash elastic search 输出配置

logstash elastic search output configuration based on inputs

elasticsearch

logstash-configuration