Below is an example of logstash pipeline to read different indices data and ingest to multiple ADX tables depending on index.
input {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "people"
user => "elastic"
password => "pwd"
tags => ["people"]
}
elasticsearch {
hosts => ["http://localhost:9200"]
index => "city"
user => "elastic"
password => "pwd"
tags => ["city"]
}
}
output {
if "people" in [tags]{
kusto {
path => "e:/tmp/kusto/%{+YYYY-MM-dd-HH-mm}.txt"
ingest_url => "https://elasticingestion.westus.kusto.windows.net"
app_id => "aad App Id"
app_key => "App sercret"
app_tenant => "App tenant"
database => "logstash"
table => "people"
json_mapping => "peoplemapping"
}
}
else if "city" in [tags] {
kusto {
path => "e:/tmp/kusto/%{+YYYY-MM-dd-HH-mm}.txt"
ingest_url => "https://elasticingestion.westus.kusto.windows.net"
app_id => "aad App Id"
app_key => "App sercret"
app_tenant => "App tenant"
database => "logstash"
table => "city"
json_mapping => "citymapping"
}
}
}