# How to parse single line for different outputs
**URL:** https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696
**Category:** Logstash
**Created:** [December 21, 2015, 1:08pm UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696 "2015-12-21T13:08:46Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Igor\_Belykh](https://discuss.elastic.co/u/Igor_Belykh)
#### Post date: [December 21, 2015, 1:08pm UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/1 "2015-12-21T13:08:46Z")
Hi,
Does somebody know how to parse single line from a file and parse it for different outputs? For example: input is a log file, outputs are elasticsearch indices with different templates. I need to parse every line and save it into the first index and some of files which has a promo code (like "?promo=wteaewfsthser") I need to put to another index. I think it's possible to use two logstash instances (correct me if I'm wrong please). But I want to know is it possible to use single instance of logstash and one configuration file?
Thanks,
Igor
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 22, 2015, 6:38am UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/2 "2015-12-22T06:38:19Z")
You probably want [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)
ie you create your grok pattern, and then if an event contains `[list of things you want]`, then send to output A and B!
---
### Author:  [@Igor\_Belykh](https://discuss.elastic.co/u/Igor_Belykh)
#### Post date: [December 22, 2015, 7:15am UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/3 "2015-12-22T07:15:44Z")
Hi Mark,
Thanks for your response, but the problem within the document structure. For the output A I need IP, Date, HTTP Method, Request, Response code, Referrer. For the output B I need only Date, Referrer, and Promo.
Thanks,
Igor
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 22, 2015, 7:23am UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/4 "2015-12-22T07:23:12Z")
Ahh ok.
Then you probably want to [clone](https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html) the initial event and then do your manipulation to it, tag it separately and then use conditionals.
---
### Author:  [@Igor\_Belykh](https://discuss.elastic.co/u/Igor_Belykh)
#### Post date: [December 22, 2015, 8:43am UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/5 "2015-12-22T08:43:01Z")
Yes, that's exactly what I was looking for!!! Thanks a log Mark.👍
---
### Author:  [@Igor\_Belykh](https://discuss.elastic.co/u/Igor_Belykh)
#### Post date: [December 22, 2015, 6:57pm UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/6 "2015-12-22T18:57:13Z")
Hi Mark,
I found that the clone filter is what I needed. But also I found that I cannot use conditions to determine either event is original or cloned. Here's my configuration file:
```
input {
file {
path => "access.log"
start_position => beginning
}
}
filter {
clone {
clones => ["cloned"]
}
if "cloned" == type {
mutate {
add_tag => ["cloned"]
}
}
}
output {
stdout {codec => json}
}
```
The tag `cloned` will not be added to any event. Do you know any solution? Or maybe the configuration is incorrect? I use Logstash 1.4.5.
Thanks,
Igor
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 22, 2015, 8:06pm UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/7 "2015-12-22T20:06:19Z")
Try putting the add tag in the `clone` section - [https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html#plugins-filters-clone-add\_tag](https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html#plugins-filters-clone-add_tag)
---
### Author:  [@Igor\_Belykh](https://discuss.elastic.co/u/Igor_Belykh)
#### Post date: [December 22, 2015, 8:08pm UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/8 "2015-12-22T20:08:38Z")
yes, i've tried but still the same result. Also I've tried to put new field. No success.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 22, 2015, 8:13pm UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/9 "2015-12-22T20:13:15Z")
> [@Igor\_Belykh](#):
>
> clones =\> ["cloned"]
I think [the docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html#plugins-filters-clone-clones) imply that the array in the above needs to be the type of the origin event.
Try adding `tags => ["cloned"]` to the input?
---
### Author:  [@Igor\_Belykh](https://discuss.elastic.co/u/Igor_Belykh)
#### Post date: [December 22, 2015, 8:19pm UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/10 "2015-12-22T20:19:08Z")
now event not cloned
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:17am UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696/11 "2017-07-06T05:17:30Z")