# Logstash pipeline: Beats → Elasticsearch
# Generated by RDT (Rambo Docker Tools)
# Service: {{ service_name }}
# Mode: beats-es
{% set es_host = logstash_es_host | default(smart_env.LOGSTASH_ES_HOST) | default('elasticsearch:9200') %}

input {
  beats {
    port => 5044
  }
}

filter {
  # Add your filter rules here
  # Example: grok, mutate, date, etc.
}

output {
  elasticsearch {
    hosts => ["http://{{ es_host }}"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
{% if logstash_es_user is defined and logstash_es_user %}
    user => "{{ logstash_es_user }}"
    password => "{{ logstash_es_password | default('') }}"
{% endif %}
  }
}

