I have events coming in with an ID of 123. Is it possible to have this event indexed into two different indices by doing something like below?
output {
if [log] == 123 {
elasticsearch {
index => "123logs"
}
}
elasticsearch {
index => "all_logs"
}
}