Duplicating Event To Multiple Indices

[wwalker (Walker)]

I have events coming in with an ID of 123. Is it possible to have this event indexed into two different indices by doing something like below?

output {
  if [log] == 123 {
    elasticsearch {
      index => "123logs"
    }
  }
  elasticsearch {
    index => "all_logs"
  }
}

[Badger]

@wwalker

Is it possible to have this event indexed into two different indices by doing something like below?

Yes, you can use conditionals to route some messages to multiple outputs.

[wwalker (Walker)]

So, just to be clear, an event continues to process all outputs until there are none left, it does not stop processing outputs on first match?

[Badger]

That is correct.