1

I want to output the same logging to two elastic search indecies. I always want the logging to the default (first) output, but I also want it to log to another index if the message type is of foo_message. When we run the following I only get the output to the second index when the type is foo_message and never to the default output.

I have seen other answers that do a similar thing, for example the answer to this thread.

What am I doing wrong? I am using Logstash&Elasticsearch v6.7.0

output {
    stdout { codec => rubydebug } 

    elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "%{[@metadata][es.indexname]}-%{+YYYY.MM.dd}"
    }

    if [@metadata][message_type] == "foo_message" {
        elasticsearch {
            hosts => ["127.0.0.1:9200"]
            index => "%{[@metadata][es.indexname.foo]}-%{+YYYY.MM.dd}"
        }   
    }
}
Freece
  • 454
  • 5
  • 11

0 Answers0