Filtered and unfiltered outputs

Elastic Stack Logstash
1

I would like to be able to take a copy of each incoming Beats event and output directly to a file, then pass the events through a filter and output to Elasticsearch, i.e.
Input->Output (file)->Filter->Output(Elasticsearch).

Of course what will happen is Input->Filter->Output(file)->Output(Elasticsearch).

Does anyone know of a way to create both filtered and unfiltered outputs from within one pipeline?

Many thanks

2

You can use the clone filter to create a copy of the original event with another type or a certain tag and use that tag as a filtering condition for extra filters or outputs.

3

Thank you paz, that looks exactly like what I need

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.