How to change "type" keyword in clone plugin

Elastic Stack Logstash
1

clone plugin default use "type" keyword. In my logstash configuration I use multiple times "type" keyword and now i need to add clone filter plugin in my logstash configuration.
How can i use this plugin without using "type" keyword ? Its ok to use keyword but not same with "type". My aim is like below

filter {
  clone {
    clones => ["cloned"]
  }
  if [new_type] == "cloned" {
    # this filter
  } else {
    # that filter
  }
}

output {
  if [new_type] == "cloned" {
    elasticsearch {
      ... index2 ...
    }
  } else {
    elasticsearch {
      ... index1 ...
    }
  }
}
2

The clone filter unconditionally sets the type field. If you are already using that then you would need to do something like

mutate { rename => { "type" => "oldtype" } }
clone { ... }
mutate { rename => { "type" => "newtype" } }
mutate { rename => { "oldtype" => "type" } }
3

I have tried your answer like below;

filter {
  mutate { rename => { "type" => "new_type" } }
  clone {
    clones => ["cloned"]
  }
  if [new_type] == "cloned" {
     # There are some operation like 
     mutate {
         replace => { type => "first_type"} 
     }
     if ... {
         mutate {
            replace => { type => "second_type"} 
        }
     }
     ....
  } else {
     # There are some operation like 
     mutate {
         replace => { type => "first_type"} 
     }
     if ... {
         mutate {
            replace => { type => "second_type"} 
        }
     }
     ....
  }
}

output {
  if [new_type] == "cloned" {
      stdout {
          codec => rubydebug
      }
  }
}

When I run this I got nothing to see. That didn't solve. I can only see "type" in output.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.