Considering that the basic structure of a logstash.conf is:
input {
...
}
filter {
...
}
output {
...
}
Looking above we assume that logstash will process the incoming events on that order (input, filter, output).
Can I use output first to enrich data (using http output plugin) for example then use a filter and the output again to send it to elasticsearch like below:
input {
...
}
output {
...http output...
}
filter {
...
}
output {
...elasticsearch...
}
Will this work or it will process in the order input, filter, output, ouput?