Keep raw syslog event untampered

Elastic Stack Logstash
#1

Hi There,

I have Logstash config with few groks to rename fields, make values human readable, geoip, and few more stuffs. I would like to make two outputs:

  1. Raw compressed file with untampered, this means it must not include any of the filters
  2. Elasticsearch output after applying all filters

Can anyone please help me here?

Regards,

Ajay

#2

Use a clone filter to split each event in two. Use conditionals to apply your filters to one of the events and similarly to send them to different inputs.

#3

Yes this should meet the requirement. Thank you.

#4

Just now tested. This works as expected.
Once again thank you for this quick help.

#5