Filter out the same event and send to different outputs

Elastic Stack Logstash
1

What I want is, the event i get from the Beats by listening to the port 5044, to send a filtered version of the event to one output and send a differently filtered version to the other output.

That is the general question but specifically in my case one of the two outputs will get the whole event as it came from the Beats.

Any good strategies on how to implement this? I have heard of Clone filter but from what i have seen it just clones specific fields to a tag or type field in the original event! While i don't want any correlation between the two events that get to the output.

2

You can implement that using a clone filter and an if/else block to drive different processing and a second if/else in the output section to determine the output. Alternatively you could use pipeline to pipeline communication with a forked-path pattern.

3

The pipeline to pipeline make more sense to me, but what about the if/else option? Do you have an small example? How I'm gonna take and send different specific fields to each output? They should not have any correlations between them.

Also i saw the forked pattern. Is it mandatory to put everything inside the pipelines.yml file?
because i have a big .conf file for one of my pipelines

4

No, it is just easier to create self-contained examples for documentation using config.string instead of path.config.

1 Like
5

Thanks for all the info, my question was made because i didn't see a pipeline input or output filter in the docs.
Anyways thanks again

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.