logstash另类输出到es

filebeat配置文件：

filebeat.inputs:

- type: log
  enabled: true
  paths:
    - /opt/hkd-cloud/hkd-custom/hkd-custom.out
  fields: 
    log_source: test_custom
  fields_under_root: true

logstash输出到es

output {

    elasticsearch {
      hosts => ["http://172.17.107.187:9203", "http://172.17.107.187:9201","http://172.17.107.187:9202"]
      index => "filebeat_%{[log_source]}-%{+YYYY.MM.dd}"
      user => "elastic"
      password => "escluter123456"
    }

}

注意：index索引这儿需要加上中括号[]

posted @ 2020-01-16 11:23  哈喽哈喽111111  阅读(765)  评论(0)  编辑  收藏  举报