Has anyone had success/failure using multiple ES destinations in syslog-ng.
I am want to direct traffic to different indexes based on syslog-ng filters
destination d_es {
elasticsearch2(
client-mode("http")
index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
type("syslog") # Description: The type of the index. For example, type("test")
template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n")
concurrent-requests("5") # Number of concurrrent batches
flush_limit("5000") # The number of messages in a single batch
skip-cluster-health-check("yes")
cluster("clustername")
client_lib_dir("/usr/share/elasticsearch/lib")
);
};
destination d_es_network {
elasticsearch2(
client-mode("http")
index("network_${YEAR}.${MONTH}.${DAY}")
type("syslog") # Description: The type of the index. For example, type("test")
template("$(format-json --scope rfc3164 --scope nv-pairs --exclude R_DATE --key ISODATE)\n")
concurrent-requests("5") # Number of concurrrent batches
flush_limit("5000") # The number of messages in a single batch
skip-cluster-health-check("yes")
cluster("clustername")
client_lib_dir("/usr/share/elasticsearch/lib")
);
};