之前在配置從logstash寫數據到elasticsearch時,指定單個數據模板沒有問題,但是在配置多個數據模板時候,總是不成功,后來找了很多資料,終於找到解決辦法,就是要多加一個配置項: template_name ,切該名字必須全部為小寫。
參考配置信息:
output { if [type] == "log_01" { elasticsearch { cluster => 'elasticsearch' host => 'x.x.x.x' index => 'log_01-%{+YYYY-MM-dd}' port => '9300' workers => 1 template => "/data/logstash/conf/template_01.json" template_name => "template_01.json" template_overwrite => true } } if [type] == "log_02" { elasticsearch { cluster => 'elasticsearch' host => 'x.x.x.x' index => 'log_02-%{+YYYY-MM-dd}' port => '9300' workers => 1 template => "/data/logstash/conf/template_02.json" template_name => "template_01.json" template_overwrite => true } } }