0

Is it possible to configure the same logstash.conf for different purposes? For example:

  • application log
  • stacktrace of errors

I have a Spring Boot application and I use logstash-logback-encoder plugin

Alessio Frabotta
  • 117
  • 11
  • Almost certainly, but you'd have to stare at https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html and figure it out. –  May 10 '18 at 16:22
  • Possible duplicate of [logstash http\_poller first URL request's response should be input to second URL's request param](https://stackoverflow.com/questions/37436376/logstash-http-poller-first-url-requests-response-should-be-input-to-second-url) – Rossiar May 10 '18 at 17:45

1 Answers1

0

Yes you can but each index needs some kind of identification like for example type or tag. I prefer using tags because you might encounter a problem when your data has field called 'type'. Take a look at the example config file below for two indexes:

input {
  file {
    path => "/log/app_log.log"
    tags => ["app_log"]
  }

  file {
    path => "/log/stacktrace.log"
    type => ["stacktrace"]
  }
}

filter {
  if "app_log" in [tags] {
  #Some fitlering for app_log  
  }
  if "stacktrace" in [tags] {
  #Some fitlering for stacktrace
  }

}

output {
   if "app_log" in [tags] {
      elasticsearch {
         index => "app_log-%{+YYYY.MM.dd}"
         hosts => ["localhost:9200"]
      }
   }
   if "stacktrace" in [tags] {
       elasticsearch {
         index => "stacktrace-%{+YYYY.MM.dd}"
         hosts => ["localhost:9200"]
       }
   }
}

You can also add as many jdbc inputs as you want. You don't have to worry about a break time between different inputs because logstash runs every input in parallel.

Michael Dz
  • 3,655
  • 8
  • 40
  • 74
  • can it also be done for tcp input? I thought about setting up two different ports and using two logstash appenders in the logback.xml – Alessio Frabotta May 10 '18 at 14:42
  • @AlessioFrabotta I never tried with tcp input but I thinkit it should work. You can always make 2 pipelines but with just a few inputs it's unnecessary complication. – Michael Dz May 11 '18 at 08:10