# Different format for different output

**URL:** <https://discuss.elastic.co/t/different-format-for-different-output/206034>\
**Category:** Logstash\
**Created:** [October 31, 2019, 12:23pm UTC](https://discuss.elastic.co/t/different-format-for-different-output/206034 "2019-10-31T12:23:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![skowron-line](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skowron-line/32/43528_2.png) [@skowron-line](https://discuss.elastic.co/u/skowron-line)\
**Post date:** [October 31, 2019, 12:23pm UTC](https://discuss.elastic.co/t/different-format-for-different-output/206034/1 "2019-10-31T12:23:09Z")

</div>

I would like to send 2 different format message to outputs so I have something like this

```
input {
    beats {
        port => 5044
    }
}
filter {
    clone {
        clones => ["message"]
        add_tag => ["siem"]
    }

    if "siem" not in [tags] {
        json {
            source => "message"
            remove_field => ["agent", "host", "input", "ecs", "tags", "log"]
        }
    }

    if "siem" in [tags] {
        json {
            source => "message"
            remove_field => ["agent", "host", "input", "ecs", "log"]
        }
        mutate {
            replace => {"message" => "%{local_time} %{level_name} %{message} %{ip} %{user} %{uri}" }            
        }
    }
}
output {
    
    elasticsearch {
        hosts => ["localhost:9200"]
        index => "audit_%{+YYYY.MM.dd}"
        manage_template => true
        template => "/usr/share/logstash/template/audit.json"
        template_name => "audit"
        template_overwrite => true
    }

    if "siem" in [tags] {
        udp {
            host => "<host>"
            port => "<port>"
        }

        file {
            path => "/var/log/logstash/siem.log"
        }
    }
}

```

but in siem.log there is still json message

---

<div class="post-metadata">

**Author:** ![st3inbeiss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/st3inbeiss/32/55332_2.png) [@st3inbeiss](https://discuss.elastic.co/u/st3inbeiss)\
**Post date:** [October 31, 2019, 12:37pm UTC](https://discuss.elastic.co/t/different-format-for-different-output/206034/2 "2019-10-31T12:37:21Z")

</div>

If you use the `clone` Filter, a second, duplicated event is generated and processed as normal event by logstash.

What are you trying to achieve with your `clone{}` block?

On Clone:  
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html)

---

<div class="post-metadata">

**Author:** ![skowron-line](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skowron-line/32/43528_2.png) [@skowron-line](https://discuss.elastic.co/u/skowron-line)\
**Post date:** [October 31, 2019, 12:55pm UTC](https://discuss.elastic.co/t/different-format-for-different-output/206034/3 "2019-10-31T12:55:52Z")

</div>

I wan to clone event and add him siem tag so I can catch him in mutate filter which will make me string message not json message

```
mutate {
            replace => {"message" => "%{local_time} %{level_name} %{message} %{ip} %{user} %{uri}" }            
        }

```

So I want to have  
json going to elasticsearch  
string going to siem

---

<div class="post-metadata">

**Author:** ![st3inbeiss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/st3inbeiss/32/55332_2.png) [@st3inbeiss](https://discuss.elastic.co/u/st3inbeiss)\
**Post date:** [October 31, 2019, 1:25pm UTC](https://discuss.elastic.co/t/different-format-for-different-output/206034/4 "2019-10-31T13:25:51Z")

</div>

My guess would be that the configuration of the clone-Filter poses an issue here.  
What `clones => ["message"]` does is, it adds the **type**"message" to the cloned event. the better option would be to make another type of event like:

```
clone {
  clones => ["clonedEvent"]
}

```

and not adding a "siem" tag.  
As conditional, you can then use something like:  
`if [type] == "clonedEvent" { ... }`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2019, 1:26pm UTC](https://discuss.elastic.co/t/different-format-for-different-output/206034/5 "2019-11-28T13:26:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.