logstash另类输出到es

filebeat配置文件：

filebeat.inputs:

- type: log
  enabled: true
  paths:
    - /opt/hkd-cloud/hkd-custom/hkd-custom.out
  fields: 
    log_source: test_custom
  fields_under_root: true

logstash输出到es

output {

    elasticsearch {
      hosts => ["http://172.17.107.187:9203", "http://172.17.107.187:9201","http://172.17.107.187:9202"]
      index => "filebeat_%{[log_source]}-%{+YYYY.MM.dd}"
      user => "elastic"
      password => "escluter123456"
    }

}

注意：index索引这儿需要加上中括号[]

logstash另类输出到es

原文：https://www.cnblogs.com/sanduzxcvbnm/p/12200313.html