# Filter out the same event and send to different outputs

**URL:** https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611
**Category:** Logstash
**Created:** [August 16, 2021, 10:03pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611 "2021-08-16T22:03:52Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![panagiss](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@panagiss](https://discuss.elastic.co/u/panagiss)
#### Post date: [August 16, 2021, 10:03pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611/1 "2021-08-16T22:03:52Z")

</div>

What I want is, the event i get from the Beats by listening to the port 5044, to send a filtered version of the event to one output and send a differently filtered version to the other output.

That is the general question but specifically in my case one of the two outputs will get the whole event as it came from the Beats.

Any good strategies on how to implement this? I have heard of Clone filter but from what i have seen it just clones specific fields to a `tag` or `type` field in the original event! While i don't want any correlation between the two events that get to the output.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 16, 2021, 10:39pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611/2 "2021-08-16T22:39:38Z")

</div>

You can implement that using a clone filter and an if/else block to drive different processing and a second if/else in the output section to determine the output. Alternatively you could use pipeline to pipeline communication with a [forked-path pattern](https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html#forked-path-pattern).

---

<div class="post-metadata">

### Author: ![panagiss](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@panagiss](https://discuss.elastic.co/u/panagiss)
#### Post date: [August 17, 2021, 8:26am UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611/3 "2021-08-17T08:26:48Z")

</div>

The pipeline to pipeline make more sense to me, but what about the if/else option? Do you have an small example? How I'm gonna take and send different specific fields to each output? They should not have any correlations between them.

Also i saw the forked pattern. Is it mandatory to put everything inside the **pipelines.yml** file?  
because i have a big .conf file for one of my pipelines

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 17, 2021, 2:35pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611/4 "2021-08-17T14:35:26Z")

</div>

> [@panagiss](#):
>
> Is it mandatory to put everything inside the **pipelines.yml** file?

No, it is just easier to create self-contained examples for documentation using config.string instead of path.config.

---

<div class="post-metadata">

### Author: ![panagiss](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@panagiss](https://discuss.elastic.co/u/panagiss)
#### Post date: [August 17, 2021, 2:40pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611/5 "2021-08-17T14:40:24Z")

</div>

Thanks for all the info, my question was made because i didn't see a pipeline input or output filter in the docs.  
Anyways thanks again

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2021, 2:40pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611/6 "2021-09-14T14:40:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
