Logstash Filtering logs

Elastic Stack Logstash
1

I want to filter logs on base of account_id and send to different output in logstash.

Log1:
{'account_id': '1234567890',
'other data': "Some_data"}

Log2:
{'account_id': '0987654321',
'other data': "Some_data"}

i want send log1 in other output and log2 in other output.
Is there any workaround?

2

You can use conditionals in the output section. See here for an example.

3

Nice. Thanks for responding.

Can we automatically put the logs in output account wise. Let's assume we have 1000 account and i want to separate logs in S3 bucket account wise prefix.

s3 {
                bucket => "abc"
                prefix => "abc/{account_id}"
           }

in prefix i'm trying to use account_id as prefix so if we have the prefix it puts the logs into that otherwise it will create new prefix with as account_id

4

Yes, the prefix option does support sprintf references, but note the warning in the source about the number of files created.

 prefix => "abc/%{account_id}"
5

Thanks for response.
can we use in operator in if condition like if i wanted to check if a filed matched to some keywords like

if [type] not in ['a', 'b', 'c'] {
                drop {}
        }
6

Yes, that will work.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.