# Forwarding the http input data to http output data

**URL:** https://discuss.elastic.co/t/forwarding-the-http-input-data-to-http-output-data/375567
**Category:** Logstash
**Created:** [March 7, 2025, 4:41pm UTC](https://discuss.elastic.co/t/forwarding-the-http-input-data-to-http-output-data/375567 "2025-03-07T16:41:31Z")
**Posts on this page:** 1
**Showing post:** 26

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 12, 2025, 8:24pm UTC](https://discuss.elastic.co/t/forwarding-the-http-input-data-to-http-output-data/375567/26 "2025-03-12T20:24:26Z")

</div>

For the original data format the following might work

```
    mutate { gsub => ["message", "\r", ""] }
    mutate { split => { "message" => "
" } }
    ruby {
        code => '
            msg = event.get("message")
            if msg.is_a? Array
                while msg.length > 1 do
                    clone = event.clone
                    clone.set("message", msg.shift(2))

                    new_event_block.call(clone)
                end
                if msg.length > 0
                    logger.warn("Content is uneven")
                    event.set("message", msg)
                else
                    event.cancel
                end
            end
        '
    }
    if [message][1] {
        json { source => "[message][1]" }
        json { source => "[message][0]" target => "[@metadata][operation]" }
    }

```

and in the output section

```
if [@metadata][index] {
    elasticsearch {
        index => "%{[@metadata][operation][index][_index]}"
        ....

```

As noted before, this doesn't handle create, update, etc.

---

_[View the full topic](https://discuss.elastic.co/t/forwarding-the-http-input-data-to-http-output-data/375567)._