Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Logstash Dynamically assign template

Tags:

logstash

I have read that it is possible to assign dynamic names to the indexes like this:

elasticsearch {
            cluster => "logstash"
            index => "logstash-%{clientid}-%{+YYYY.MM.dd}"
    }

What I am wondering is if it is possible to assign the template dynamically as well:

elasticsearch {
            cluster => "logstash"
            template => "/etc/logstash/conf.d/%{clientid}-template.json"
    }

Also where does the variable %{clientid} come from?

Thanks!

like image 409
Bradox Avatar asked Dec 10 '25 05:12

Bradox


1 Answers

After some testing and feedback from other users, thanks Ben Lim, it seems this is not possible to do so far. The closest thing would be to do something like this:

    if [type] == "redis-input" {
            elasticsearch {
                    cluster => "logstash"
                    index => "%{type}-logstash-%{+YYYY.MM.dd}"
                    template => "/etc/logstash/conf.d/elasticsearch-template.json"
                    template_name => "redis"
            }
    } else if [type] == "syslog" {
            elasticsearch {
                    cluster => "logstash"
                    index => "%{type}-logstash-%{+YYYY.MM.dd}"
                    template => "/etc/logstash/conf.d/syslog-template.json"
                    template_name => "syslog"
            }
    }
like image 143
Bradox Avatar answered Dec 14 '25 01:12

Bradox