Duplicating Event To Multiple Indices

Elastic Stack Logstash
1

I have events coming in with an ID of 123. Is it possible to have this event indexed into two different indices by doing something like below?

output {
  if [log] == 123 {
    elasticsearch {
      index => "123logs"
    }
  }
  elasticsearch {
    index => "all_logs"
  }
}
2

Yes, you can use conditionals to route some messages to multiple outputs.

3

So, just to be clear, an event continues to process all outputs until there are none left, it does not stop processing outputs on first match?

4

That is correct.