sof-elk
sof-elk copied to clipboard
Single stanza for ES outputs
Multiple ES outputs results in resource overuse, per Elastic's guidance. Merge all ES outputs to one, using a variable for the index name, e.g. index => "%{something}-%{+YYYY.MM.dd}"