Logstash config file processing order

Considering that the basic structure of a logstash.conf is:

input {
...
}
filter {
...
}
output {
...
}

Looking above we assume that logstash will process the incoming events on that order (input, filter, output).
Can I use output first to enrich data (using http output plugin) for example then use a filter and the output again to send it to elasticsearch like below:

input {
...
}
output {
...http output...
}
filter {
...
}
output {
...elasticsearch...
}

Will this work or it will process in the order input, filter, output, ouput?

It reads from the inputs, applies the filters and writes to the outputs. The order of the items in the configuration file or files does not matter. Something like

output {}
input {}
filter {}

works just the same as

input {}
filter {}
output {}
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.