So I have no issues with indexing a record from logstash, however I want to be able to index the same record to multiple indicies.
Currently in my logstash output i have this:
output{
elasticsearch {
hosts => ["myHost"]
user => "myUser"
password => "myPassword"
cacert => "myCert.pem"
index => "myIndex_primary"
document_id => "12345"
action => "update"
doc_as_upsert => true
manage_template => false
}
}
Lets say I also wanted to save the same record to a 'secondary' index. Is this possible from the same elasticsearch or would have be forces to duplicate the entire elasticsearch call?
My thought would be something like:
output{
elasticsearch {
hosts => ["myHost"]
user => "myUser"
password => "myPassword"
cacert => "myCert.pem"
index => ["myIndex_primary", "myIndex_secondary"]
document_id => "12345"
action => "update"
doc_as_upsert => true
manage_template => false
}
}
CodePudding user response:
Yes, this is possible. You need to add another elasticsearch output to the configuration file. The index
option expects a string, not an array.
So your pipeline's output section would look like this:
output{
elasticsearch {
hosts => ["myHost"]
user => "myUser"
password => "myPassword"
cacert => "myCert.pem"
index => "myIndex_primary" <--- index 1
document_id => "12345"
action => "update"
doc_as_upsert => true
manage_template => false
}
elasticsearch {
hosts => ["myHost"]
user => "myUser"
password => "myPassword"
cacert => "myCert.pem"
index => "myIndex_secondary" <--- index 2
document_id => "12345"
action => "update"
doc_as_upsert => true
manage_template => false
}
}
I hope I could help you.