Hi -- I'm sure this is simple but I can't figure it out.
Input: ES query
Output: File, exec cmd
So I query Elasticsearch and want to write those events to a single local file. That part is working.
However, the 'exec' statement (which uses the AWS S3 cp command to copy the file to a bucket) is called many times (I'm guessing once for each ES document?). How can I configure this so 'exec' is only executed one time, after the file output has been completed?
PS - I could not get the S3 Output plugin to work (it worked with stdin, but not with ES as input).