I am looking to send all logs with the tag myservicename to one elasticsearch index and everything else to another index.
Currently I am using the below config which appears to work, but is there a clean way to do it?
[SERVICE]
Flush 5
Daemon Off
Log_Level INFO
Parsers_File /fluent-bit/etc/parsers.conf
[INPUT]
Name Forward
Port 24224
Buffer_Max_Size 256KB
[OUTPUT]
Name es
Match_Regex ^(?!myservicename).*
Buffer_Size 128KB
Host <redacted>
Port <redacted>
Logstash_Format On
Logstash_Prefix logs
Include_Tag_Key On
Tag_Key image
Type _doc
[OUTPUT]
Name es
Match myservicename
Buffer_Size 128KB
Host <redacted>
Port <redacted>
Logstash_Format On
Logstash_Prefix logs-myservicename-
Include_Tag_Key On
Tag_Key image
Type _doc