LS indexes
Posted: Mon Oct 19, 2020 4:41 am
NLS uses a daily index currently.
I have multiple clients with individual PCI requirements.
For each client has 3 env. Prod, Staging, and Dev.
Is this type of filtering supported by NLS?
I have multiple clients with individual PCI requirements.
For each client has 3 env. Prod, Staging, and Dev.
Is this type of filtering supported by NLS?
Code: Select all
filter {
if [log_type] in [ "prod", "staging", "dev" ] {
mutate { add_field => { "[@metadata][target_index]" => "staging-%{+YYYY.MM}" } }
} else if [log_type] == "prod" {
mutate { add_field => { "[@metadata][target_index]" => "prod-%{+YYYY.MM.dd}" } }
} else if [log_type] == "dev" {
mutate { add_field => { "[@metadata][target_index]" => "dev-%{+YYYY.MM.dd}" } }
}
output {
elasticsearch {
index => "%{[@metadata][target_index]}"
}
}