Cannot use elasticsearch output module twice

Elastic Stack Logstash
1

Hi All,

I'm trying to configure Logstash 2.3.2 to call the elasticsearch output module twice as I'm migrating to a new cluster. Calling the module once for either cluster works fine, but if I call it twice no packets are sent to either destination? Any ideas?

-Cheers Max.

2

What does your configuration look like?

3

Hi Christian, as follows...

input {
  syslog {
    port => '6514'
    type => 'syslog'
  }
}
output {
  if [type] == "syslog" {
    elasticsearch {
      hosts => [ "127.0.0.1" ]
    }
    elasticsearch {
      hosts => [ "elasticsearch01","elasticsearch02","elasticsearch03" ]
    }
  }
}

-Cheers, Max.

4

Why do you need two instances, you could have the list of hosts in the same instance and will do the same work.

One situation where you could have multiple outputs of the same class, for example elasticsearch is if they stay in different conditional blocks, for example:

  if [type] == "foo" {
    elasticsearch {}
  } else {
    elasticsearch {}
  }