Is output order guaranteed?

Elastic Stack Logstash
1

If I have several outputs defined, are my events guaranteed to hit each output in the order they are defined?

I want to have an output plugin add a tag if it fails and have a conditional that will send my event to a file if that tag exists. It would look like this:

output {
    my_custom_output_plugin {}

    if "failed_custom_output" in [tags] {
        file {
            path => "/var/log/failed_to_send.log"
        }
    }
}

The logic to add the tag would exist in the custom output plugin. Would something like this work?

2

I am not certain, but I believe ordering is effectively random. The outputs run independently.

3

It's my understanding that the outputs are shared resources that the pipeline workers need to grab a lock for. It would make sense that instead of blocking on one output it would work on others first but I can't find anything that documents this behavior.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.