Common filter(s) for multiple pipelines?

Elastic Stack Logstash
1

I have multiple pipelines feeding into logstash (metricbeat, filebeat, winlogbeat, etc.) and each of them share some common filters. I am wondering if there is a way to have some filters in a location that each of the pipelines can access so I don't need to have the filters copied in every single pipeline.

Is this possible? Is there any way at all to have common filters reused by multiple pipelines?

2

There's nothing built-in for this but you can simply symlink your configuration files into the various directories where you want them.

3

I ended up using pipeline-to-pipeline communication and also using conditional logic in the "Output" section of my pipeline. You can include multiple "Inputs" perform the same filters on all of those inputs and then use conditional logic in the output section to distribute each event to the desired index or to another pipeline. Hope this helps anyone with a similar question.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.