Fields mixed in index pattern creation

Plugins Index Management
1

In logstash I load two conf files, and when creating the ‘index pattern’ it mixes the fields of both indexes. Does anyone know how to avoid this situation? The conf’s output is bellow:

output {
   #if [type == "A1001"] {
   opensearch {
        action => "index"
        hosts => ["https://opensearch-node1:9200","https://opensearch-node2:9200"]
        index => "data01"
        document_id => "%{identificador}"
        document_type => "_doc"
        user => "*****"
        password => "***"
        ssl => true
        ssl_certificate_verification => false
          }
    #}
}
2

Hi @leonardo - I think if you want the opensearch output to use two different indices you’ll have to use some conditionals to change the ‘index’ to use two distinct indices. I don’t see any logic that ever switches away from ‘data01’ as the index.

Also, you may want to check that the pattern you used to create your index pattern doesn’t match more than one index.

3

Thanks @nateynate. In this case, I don’t want one output with two indices. I have two files (.conf) and both of its fields are mixing at IndexPattern creation and the name of the pattern’s are completely different.

4

Do the patterns in question start with the same text? I noticed that when creating a pattern (through the UI) it adds an asterisk at the end by default. I’ve had to backspace over it. Have you created index patterns that match more than one index?