LS indexes

[newmember]

NLS uses a daily index currently.

I have multiple clients with individual PCI requirements.
For each client has 3 env. Prod, Staging, and Dev.

Is this type of filtering supported by NLS?

Code: Select all

filter {
      if [log_type] in [ "prod", "staging", "dev" ] {
        mutate { add_field => { "[@metadata][target_index]" => "staging-%{+YYYY.MM}" } }
      } else if [log_type] == "prod" {
        mutate { add_field => { "[@metadata][target_index]" => "prod-%{+YYYY.MM.dd}" } }
      } else if [log_type] == "dev" {
        mutate { add_field => { "[@metadata][target_index]" => "dev-%{+YYYY.MM.dd}" } }
    }
    output {
      elasticsearch {
        index => "%{[@metadata][target_index]}"
      }
    }

[cdienger]

A filter like this can be put in place, but any sort of maintenance NLS does on indexes would no longer work since it is hardcoded to look for logstash-YYYY.MM.DD. Alerting would also no longer work for the same reason.

Dashboards would also need to be configured to use the new indexes.