This repository was archived by the owner on Dec 15, 2021. It is now read-only.

Description
Hello, I have a "type" field in my data that I DON'T want to be mapped to the index - that is a different field (called assetType). Logstash seems to be taking my "type". I know I could override that by setting document_type in my output, but I have two tables I want to map into two different Elastic indexes in my output - like this;
output {
if[type] == 'story' {
elasticsearch {
hosts => ["10.0.2.15:9200"]
index => "storys"
document_type => "%{assetType}"
document_id => "%{assetId}"
}
}
stdout {}
}
but I want to do this (use assetType)
output {
if[assetType] == 'story' {
elasticsearch {
hosts => ["10.0.2.15:9200"]
index => "storys"
document_type => "%{assetType}"
document_id => "%{assetId}"
}
}
stdout {}
}
.....but I can't do that, as type is being used automatically, and is the only field I can use in my input....
Does anyone know how I can tell logstash the "type" field is actually my assetType value?