How to make output to two index using logstash

Hi, I have established connection from filebeat to logstash with below configuration.
It is working fine.

    input {
      beats {
        port => 5044

    filter {
    output {
     elasticsearch {
        hosts => ["http://localhost:9200"]
        index => "%{[@metadata][beat]}-%{[@metadata][version]}" 
      stdout { codec => rubydebug }

My Core intention is have to collect few fields from incoming document and wanted to index the content in another index. In my case both has to happen one is as per current config it index all the incoming data that has to happen another one is gather few fields from incoming document and process it then have to index the processed documents in separate index.

Kindly some one help me to achieve this. Thanks in advance.

Perhaps use pipeline-to-pipeline communication with a forked path pattern.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.