# How to output filter results before applying next filter

**URL:** <https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862>\
**Category:** Logstash\
**Created:** [August 30, 2017, 2:07pm UTC](https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862 "2017-08-30T14:07:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leluke](https://avatars.discourse-cdn.com/v4/letter/l/e79b87/32.png) [@Leluke](https://discuss.elastic.co/u/Leluke)\
**Post date:** [August 30, 2017, 2:07pm UTC](https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862/1 "2017-08-30T14:07:49Z")

</div>

Hi there, I would like to be able to debug my pipeline configuration. I apply a series of filters, and at the end I output to a json file. It works as it should, and a skeleton of the code would be this:

filter {  
whatever1  
}  
filter {  
whatever2  
}  
filter {  
whatever3  
}  
output {  
file { path=\> output\_file}  
}

What Id like to do is, I would like to be able to output in between filters to different files, so that I can see what the event looks like after each filter. I would like to see the gradual effects of my filters so I can debug them separately. Something like:

filter {  
whatever1  
}  
output {  
file { path=\> output\_file\_1}  
}  
filter {  
whatever2  
}  
output {  
file { path=\> output\_file\_2}  
}  
filter {  
whatever3  
}  
output {  
file { path=\> output\_file\_3}  
}

But when I do this, all the outputs are executed after the filters have been applied. Is there a was to do this, or should I just gradually test the output of each filter, one by one?

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [August 30, 2017, 2:21pm UTC](https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862/2 "2017-08-30T14:21:33Z")

</div>

There's not really a way to have an output at each stage as Logstash groups inputs-\>filters-\>outputs together. Your best bet is to test one chunch at a time.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 30, 2017, 2:58pm UTC](https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862/3 "2017-08-30T14:58:30Z")

</div>

You could use a clone filter to make a copy of events at certain points.

---

<div class="post-metadata">

**Author:** ![Leluke](https://avatars.discourse-cdn.com/v4/letter/l/e79b87/32.png) [@Leluke](https://discuss.elastic.co/u/Leluke)\
**Post date:** [August 30, 2017, 5:11pm UTC](https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862/4 "2017-08-30T17:11:24Z")

</div>

This was exactly what I wanted, thank you! This is the solution, if anyone comes to this thread.  
Just make sure your filters and outputs use the correct types when you control the flow of the program, so that you dont apply filters to the created event clone types, and for those types you output to file.

Logstash will work as it should, grouping inputs, filters and outputs, but it works since the filters are not applied.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2017, 5:11pm UTC](https://discuss.elastic.co/t/how-to-output-filter-results-before-applying-next-filter/98862/5 "2017-09-27T17:11:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.