# Creating global array in logstash and sharing the same

**URL:** <https://discuss.elastic.co/t/creating-global-array-in-logstash-and-sharing-the-same/111354>\
**Category:** Logstash\
**Created:** [December 12, 2017, 2:08pm UTC](https://discuss.elastic.co/t/creating-global-array-in-logstash-and-sharing-the-same/111354 "2017-12-12T14:08:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![naveenk](https://avatars.discourse-cdn.com/v4/letter/n/e47c2d/32.png) [@naveenk](https://discuss.elastic.co/u/naveenk)\
**Post date:** [December 12, 2017, 2:08pm UTC](https://discuss.elastic.co/t/creating-global-array-in-logstash-and-sharing-the-same/111354/1 "2017-12-12T14:08:09Z")

</div>

Hi,

I would like to create global array/map based on jdbc input plugin. And share the same array with in filebeat event.

Example(Sample Macro Code)

input {

jdbc {

// contains business logic details  
}

beats {  
//contains input data  
}

}

filter {

if 'message' is from jdbc {  
//create global array/ or map and holds the business logic rules  
}

if 'message' is from 'filebeat' {  
//use the global array business logic rule and apply it into each event of filebeat  
}

output {  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 12, 2017, 2:31pm UTC](https://discuss.elastic.co/t/creating-global-array-in-logstash-and-sharing-the-same/111354/2 "2017-12-12T14:31:41Z")

</div>

Please explain your end goal instead. In what way do you want to apply your global business logic rules? What is their function?

---

<div class="post-metadata">

**Author:** ![naveenk](https://avatars.discourse-cdn.com/v4/letter/n/e47c2d/32.png) [@naveenk](https://discuss.elastic.co/u/naveenk)\
**Post date:** [December 13, 2017, 4:29pm UTC](https://discuss.elastic.co/t/creating-global-array-in-logstash-and-sharing-the-same/111354/3 "2017-12-13T16:29:23Z")

</div>

Hey @magnusbaeck , Thanks for your reply.

I had setup a filebeat to pull a logs. And i want to apply some business logic which is residing in DB and push the final result to elastic. How can I share business rules/logic in DB with filebeat events in logstash.

Options i explored:

1. Pushing filebeat event(message) to http output plugin. And in that output http application i can access the business logic from DB , apply the business logic and finally push it to elasticsearch
2. Output exec plugin (almost similar to option1)

Let me know if this cause any performance issue or is there any better approach?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 13, 2017, 7:16pm UTC](https://discuss.elastic.co/t/creating-global-array-in-logstash-and-sharing-the-same/111354/4 "2017-12-13T19:16:21Z")

</div>

Have you looked at the jdbc\_streaming filter?

---

<div class="post-metadata">

**Author:** ![naveenk](https://avatars.discourse-cdn.com/v4/letter/n/e47c2d/32.png) [@naveenk](https://discuss.elastic.co/u/naveenk)\
**Post date:** [December 14, 2017, 1:55am UTC](https://discuss.elastic.co/t/creating-global-array-in-logstash-and-sharing-the-same/111354/5 "2017-12-14T01:55:44Z")

</div>

Hey @magnusbaeck, tried with jdbc\_streaming and i am able to achieve my requirement. Thanks !!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2018, 1:55am UTC](https://discuss.elastic.co/t/creating-global-array-in-logstash-and-sharing-the-same/111354/6 "2018-01-11T01:55:51Z")

</div>

Closed on January 11, 2018, 1:55am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.