Logstash Indexing

Question

I would like to create two separate indexes for two different systems that are sending data to the logstash server setup for udp - syslog. In Elasticsearch, I created an Index called CiscoASA01 and another Index called CiscoASA02. How can I configure Logstash to filter all events coming from the first device to go into the CiscoASA01 index and the events coming from the second device to go to the second index? Thank you.

Answer 1

You can use if to separate the logs. Assume your first device is CiscoASA01 & second is CiscoASA02.

Here is the output

output {
    if [host] == "CiscoASA01"
    {
            elasticsearch {
                    host => "elasticsearch_server"
                    index => "CiscoASA01"
            }
    }

    if [host] == "CiscoASA02"
    {
            elasticsearch {
                    host => "elasticsearch_server"
                    index => "CiscoASA02"
            }
    }
}

The [host] is the field in logstash event. You can use it to separate the log to different output.

Hope this can help you.