Creating an error index

Hi all,

So I am in the processing of migrating configs for my technologies from the grok filter to dissect filter. I want to output the dissect tag failures into a separate error index and the parsed data in another index.

I know I can do conditionals in the output section, but is there any way I could forward it to a indices at the filter section?

Regards,
Kabi

I know I can do conditionals in the output section, but is there any way I could forward it to a indices at the filter section?

No. What's wrong with using conditionals in the output section?