CODEWITHSUNDEEP
regexelasticsearchlogstashlogstash-grok
Brian KITHEN
Brian KITHEN

Reputation: 11

Creating Index based on another field in logstash

this question was asked 3 months ago. One of the answers helped me but doesn't solve evey issues.

I am new to ELK and I have an issue to build the index based on another field.

Alain Collins solution (see link) is pretty good: I could format the index as I wanted but the send_to field appears in the output and the field cannot be removed. send_to acts as a temporary variable used in the index. Is there any way to not output the send_to field ?

Upvotes: 1

Views: 533

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

Sure - use a relatively new feature called metadata.

Put the value in a field like [@metadata][send_to], which you can then refer to in the output stanza. metadata fields aren't sent to elasticsearch, so they won't "pollute" your documents.

Upvotes: 1

Related Questions