i am trying to create index name same as filename from source but it doesn't seem to work, here's my logstash config file :
input {
beats{
port=> 5044
}
}
filter {
grok {
match => ["source",".*\\%{GREEDYDATA:app_name}"]
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["localhost:9200"]
index => "%{app_name}"
}
}
logs sample :
07:52:29.040 [ORB.thread.pool : 0][INFO ] ServiceArriereGuichet - @PostConstruct ServiceArriereGuichet 2020-02-17 08:05:33 INFO certification - Traitement Flux XML 2020-02-18 08:27:08,603 INFO info : Fin de construction du flux de sortie.
pattern test:
I've found the solution, i have used [log][file][path] instead of source and i used mutate to transform it to lowercase, now it's creating indexes based on the source filename.
thank you all!