Search code examples
elasticsearchlogstashcollectd

Multiple Logstash Outputs depending from collectd

I'm facing a configuration failure which I can't solve on my own, tried to get the solution with the documentation, but without luck.

I'm having a few different hosts which send their metrics via collectd to logstash. Inside the logstash configuration I'd like to seperate each host and pipe it into an own ES-index. When I try to configtest my settings logstash throws a failure - maybe someone can help me.

The seperation should be triggered by the hostname collectd delivers:

[This is an old raw json output, so please don't mind the wrong set index]

{
  "_index": "wv-metrics",
  "_type": "logs",
  "_id": "AVHyJunyGanLcfwDBAon",
  "_score": null,
  "_source": {
    "host": "somefqdn.com",
    "@timestamp": "2015-12-30T09:10:15.211Z",
    "plugin": "disk",
    "plugin_instance": "dm-5",
    "collectd_type": "disk_merged",
    "read": 0,
    "write": 0,
    "@version": "1"
  },
  "fields": {
    "@timestamp": [
      1451466615211
    ]
  },
  "sort": [
    1451466615211
  ]
}

Please see my config:

Input Config (Working so far) 

input {
  udp {
    port => 25826
    buffer_size => 1452
    codec => collectd { }
  }
}

Output Config File: 

filter {
if [host] == "somefqdn.com" {
output {
  elasticsearch {
   hosts => "someip:someport"
   user => logstash
   password => averystrongpassword
   index => "somefqdn.com"
                }
          }
     }
}

Error which is thrown: 

root@test-collectd1:/home/username# service logstash configtest
Error: Expected one of #, => at line 21, column 17 (byte 314) after filter {
if [host] == "somefqdn.com" {
output {
  elasticsearch

I understand, that there's a character possible missing in my config, but I can't locate it.

Thx in advance!

Solution

  • I spot two errors in a quick scan:

    First, your output stanza should not be wrapped with a filter{} block.

    Second, your output stanza should start with output{} (put the conditional inside):

    output {
    if [host] == "somefqdn.com" {
        elasticsearch {
            ...
        }
    }
}