Can we apply 2 filter in 1 logstash conf file. I wanted to parse 1 log twice and send the message to multiple outputs. e-g
1 filter to remove some fields and send the message to output
2nd filter doing another check and having the fields which is removed by filter 1 and sending to multiple outputs.
I believe this is either/or and that if both are supplied then one will be ignored. I suspect it is using config.string. That has no input, so even if it is started the pipeline will immediately shut down, leaving in the non-running bucket.
I think that you can provide both path.config and config.string and it will concatenate the configs, at least you could do that in older versions, do not know the newer ones because I do not use config.string.
I would suggest that you move the config out of the pipelines.yml into files, just create a config file for abc and def pipelines and use path.config pointing to them, also add the output of the main-intake pipeline in the intake.conf file.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.