Search code examples
logstashfilebeat

Problem creating dynamic index from filename (filebeat)


i am trying to create index name same as filename from source but it doesn't seem to work, here's my logstash config file :

input {
  beats{
 port=> 5044
 }
}

 filter {
 grok {
      match => ["source",".*\\%{GREEDYDATA:app_name}"]
   }
}
  output {
    stdout {
     codec => rubydebug
      }
     elasticsearch {
      hosts => ["localhost:9200"]
     index => "%{app_name}"
   }
 }

logs sample :

07:52:29.040 [ORB.thread.pool : 0][INFO ] ServiceArriereGuichet - @PostConstruct ServiceArriereGuichet 2020-02-17 08:05:33 INFO certification - Traitement Flux XML 2020-02-18 08:27:08,603 INFO info : Fin de construction du flux de sortie.

pattern test:

enter image description here


Solution

  • I've found the solution, i have used [log][file][path] instead of source and i used mutate to transform it to lowercase, now it's creating indexes based on the source filename.

    thank you all!