
input
{
    beats {
        port => "10514"
        ecs_compatibility => "v8"
    }
}

output
{
    if [event][module] =~ "system"
    {
        elasticsearch
        {
            index => "logstash-system-%{+YYYY.MM.dd}"
            hosts => ["172.21.225.11:9201"]
            manage_template => false
        }
    }
    else if [kind] =~ "access" or [kind] =~ "management"
    {
        elasticsearch
        {
            index => "logstash-access-%{+YYYY.MM.dd}"
            hosts => ["172.21.225.11:9201"]
            manage_template => false
        }
    }
    else
    {
        elasticsearch
        {
            index => "logstash-vitam-%{+YYYY.MM.dd}"
            hosts => ["172.21.225.11:9201"]
            manage_template => false
        }
    }
}
