@Xucito, let's say you set path to something like /path/to/my/file/log-%{type}. In that scenario, you'd expect that events coming through with types of error, warn, and info would be written to the files log-error, log-warn, and log-info, respectively. Inside the plugin's output() method, you'd have to retrieve the value of each event's type field, check if the currently-open file matched that name and if not, open or create a file with the proper name before writing to it.
Of course, if there were a large number of different values in the event's type field, you could end up creating lots of different files which would probably not be ideal.
I see, so the configuration itself is still only set during initialization however it will contain the instructions of where in the event object to look. The approach would be that one of fields contains the actual payload you may want to send and the other fields would contain the configuration values.
i.e. in syslog output plugin, the message field is assumed to be the actual payload
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.