logstash/adding_field.conf at master · ifelsenayeem/logstash · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
input {
  elasticsearch {
    hosts => "192.168.2.1"
    user => "elastic_username"
    password => "elastic_password"
    index => "index_name"
    query => '{
                "query":{
                   "range":{
                      "timestamp":{
                          "gt": "2018-02-16T00:00:00+00:00",
                          "lt": "2018-03-08T10:08:21+00:00"
                      }
                   }
                }
             }'
    docinfo => true
  }
}


filter {
  elasticsearch {
    add_field => { "key" => "value" }
    tag_on_failure => []
  }
}


output {
  elasticsearch {
    hosts => "192.168.2.1"
    user => "elastic_username"
    password => "elastic_password"
    index => "%{[@metadata][_index]}"
    document_type => "%{[@metadata][_type]}"
    document_id => "%{[@metadata][_id]}"
  }
}