3 years ago

Category: Data

October 12th 2020Getting Started 2 min read Tip: To edit your Logstash filters for any Stack choose View Stack Settings > Logstash Pipelines from your Dashboard. If your sending your data via an Elastic beat such as Filebeat your condition should be: mutate { replace => {"[@metadata][beat]" => “YOURINDEXNAME” }}

if[FIELD] == "CONDITION"{ mutate { add_field => {"[@metadata][beat]" => "YOURINDEXNAME"} }}

So if you wanted to have your IIS logs in their own index you could add: if[type] == "iis"{ mutate { add_field => {"[@metadata][beat]" => "iis"} }}