conditionals in output config
NanoPish opened this issue · 3 comments
NanoPish commented
To have multiple output indices, like in https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/2
We use this syntax:
output.elasticsearch:
hosts: ["elastic1:9200", "elastic2:9200"]
indices:
- index: "filebeat-%{[agent.version]}-apache-%{+yyyy.MM.dd}"
when.equals:
event.module: "apache"
- default: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
I have been struggling hard to make ansible to_nice_yaml produce such output. I wonder if it is even possible. What is hard is you need to use an array to obtain the - index: XXXX part, but also you need the when to be indented at the same level...
How do you guys make this work ?
NanoPish commented
elasticsearch.indices:
- index: "MY_INDEX"
when.equals: "event.module: haproxy"
is invalid yaml
NanoPish commented
elasticsearch.indices:
- index: "MY_INDEX"
when.equals: "event.module: haproxy"
is valid yaml
but is invalid filebeat.yml :
elasticsearch.indices:
- index: MY_INDEX
when.equals: 'event.module: haproxy'
NanoPish commented
NVM this works:
output_conf:
elasticsearch:
hosts:
"{{ els }}:9200"
username: ""
password: ""
indices:
- index: "filebeat-%{[agent.version]}-haproxy-%{+yyyy.MM.dd}"
when.equals:
event.module: "haproxy"