# Logstash 2.1.1 : Routing output to multiple clusters

**URL:** <https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165>\
**Category:** Logstash\
**Created:** [December 30, 2015, 10:24am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165 "2015-12-30T10:24:53Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Post date:** [December 30, 2015, 10:24am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165/1 "2015-12-30T10:24:53Z")

</div>

Hi,  
I have a need to route different message types to different elasticsearch clusters. I realise I could do this by having different "elasticsearch" output blocks separated by "if" conditionals. However, that is wasteful and long winded...  
What I'd like to do is set a variable containing the list of hosts for the cluster corresponding to that message type. Is this possible? If so, how would you recommend I do this?

Regards,  
David

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 30, 2015, 11:37am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165/2 "2015-12-30T11:37:24Z")

</div>

The correct way to do this is using conditionals. A single Elasticsearch output can only send data to a single cluster.

---

<div class="post-metadata">

**Author:** ![ebuildy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebuildy/32/6070_2.png) [@ebuildy](https://discuss.elastic.co/u/ebuildy)\
**Post date:** [December 31, 2015, 10:03am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165/3 "2015-12-31T10:03:17Z")

</div>

You could try to use:

[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-hosts](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-hosts)

With a value from your message.

`hosts => ["my-cluster-%{cluster}:9200"]`

PS: I didn't try it

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 4, 2016, 11:55am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165/4 "2016-01-04T11:55:17Z")

</div>

In addition to what other folks have suggested, you can use the translate filter to look up a message type in a table and obtain a hostname. That way you don't have to reload the Logstash configuration when you want to update the mapping table.

---

<div class="post-metadata">

**Author:** ![dawiro](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Post date:** [January 5, 2016, 9:09am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165/5 "2016-01-05T09:09:26Z")

</div>

Is the translate yaml dictionary file read once or each time the filter is applied?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 5, 2016, 9:32am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165/6 "2016-01-05T09:32:41Z")

</div>

The YAML file is periodically read. See [the documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html#plugins-filters-translate-refresh_interval).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:16am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165/7 "2017-07-06T05:16:47Z")

</div>


