Logstash how to store partial info from the log


I came across a use case where I need to store some value from the log in two different places

ex - parsed log is :- {"message" : "log_message" , "source" : "internet" , "time" : "sometime" , "id" :"123" }

Now I need to store the log into elasticsearch , that I can do very easily using elasticsearch output plugin.But at the same time I want id from the above log to be stored in a file , for that
I can use file output plugin but I do not want to store the full log , but only the id.

Is there any plugins available for that ? If no how can I achieve this ?


If I understand you well, you want to configure the codec of your output
as explained on the plugin documentation https://www.elastic.co/guide/en/logstash/current/plugins-outputs-file.html

In your case to write for one event id per line, you would simply do:

output {
  file {
    path => ...        
    codec => line { format => "%{id}" }
1 Like