Configuring Business Logs to Different Repositories

TLDR xy asked about directing business logs to separate repositories. Ashish and Prabhat guided on configuring the log forwarder and setting up the Logstash format.

Photo of xy
xy
Thu, 17 Aug 2023 08:36:31 UTC

Hello, I'd like to inquire about how to record different business logs into separate log repositories. Similar to having different business logs correspond to different Elasticsearch indexes.

Photo of Ashish
Ashish
Thu, 17 Aug 2023 08:37:38 UTC

which log forwarder are you using for ingestion

Photo of xy
xy
Thu, 17 Aug 2023 08:39:17 UTC

this

Photo of Ashish
Ashish
Thu, 17 Aug 2023 08:40:15 UTC

in URI api/{org_id}/{log stream}/_json

Photo of Ashish
Ashish
Thu, 17 Aug 2023 08:40:41 UTC

please replace api/default/{log stream}/_json with desired value

Photo of xy
xy
Thu, 17 Aug 2023 08:43:03 UTC

Is there an example? I just used this and I'm not very familiar with it

Photo of Ashish
Ashish
Thu, 17 Aug 2023 08:45:04 UTC

```[OUTPUT] Name http Match * URI /api/default/stream1/_json```

Photo of Ashish
Ashish
Thu, 17 Aug 2023 08:45:15 UTC

you can use this with rest of section from above configuration

Photo of xy
xy
Thu, 17 Aug 2023 09:09:52 UTC

need to configure multiple inputs to distinguish different businesses and collect them as input?

Photo of Prabhat
Prabhat
Thu, 17 Aug 2023 09:50:29 UTC

yes

Photo of xy
xy
Thu, 17 Aug 2023 09:54:48 UTC

[OUTPUT] Name es Match * Host zo1-openobserve-router.openobserve.svc.cluster.local Port 5080 Logstash_Format on Logstash_Prefix_Key $kubernetes['labels']['app'] index xiaoya Replace_Dots On Retry_Limit False path /api/default http_user xxx http_passwd xxx

Photo of xy
xy
Thu, 17 Aug 2023 09:58:05 UTC

It seems simpler to use the ES plugin above

Photo of Prabhat
Prabhat
Thu, 17 Aug 2023 09:59:27 UTC

you would want to remove date from the stream name, You don't need that here

Photo of xy
xy
Thu, 17 Aug 2023 10:02:10 UTC

how to remove date from the stream name? :melting_face:

Photo of Prabhat
Prabhat
Thu, 17 Aug 2023 10:09:16 UTC

Logstash_Format off

Photo of Prabhat
Prabhat
Thu, 17 Aug 2023 10:09:39 UTC

you can try that

Photo of xy
xy
Thu, 17 Aug 2023 10:10:59 UTC

Thank you. i will try now