Logstash config file processing order


(Ranieri Mazili De Oliveira) #1

Considering that the basic structure of a logstash.conf is:

input {
...
}
filter {
...
}
output {
...
}

Looking above we assume that logstash will process the incoming events on that order (input, filter, output).
Can I use output first to enrich data (using http output plugin) for example then use a filter and the output again to send it to elasticsearch like below:

input {
...
}
output {
...http output...
}
filter {
...
}
output {
...elasticsearch...
}

Will this work or it will process in the order input, filter, output, ouput?


#2

It reads from the inputs, applies the filters and writes to the outputs. The order of the items in the configuration file or files does not matter. Something like

output {}
input {}
filter {}

works just the same as

input {}
filter {}
output {}

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.