Logstash filter based on reference set or database

Elastic Stack Logstash
1

Hello,

I have to redirect some logs based on their username (the usernames are contains in the logs) to different outputs. This list has 80 entry, so it's a lot to write this in the configuration file.

I would like to know if I can base an "if" based on a file or a database (elastic, sql, whatever) and logstash will retrieve the list to apply the filter. I didn't find it in the documentation so if you have any link :grinning_face_with_smiling_eyes:

Thank you

2

You can use a translate filter to match the usernames, then use a conditional based on the fallback option to determine whether it matched, or if different usernames need to go to different outputs use a translate filter to determine that.

3

Is the elasticsearch filter plugin is not better to do this thing ? With the translate plugin I have to write all the 80 things into the configuration file .... Elasticsearch filter plugin | Logstash Reference [7.13] | Elastic

4

That's another option, as is a jdbc_static filter or a memcached filter. There are many ways to do the lookup.