Logstash if condition in output not working

[jellydragon]

Hi, i'm trying to conditionally redirect logs to different outputs based on the presence of the tag "ERROR". Here is the code i'm using:

output {
  if "ERROR" in [tags] {
    kafka {
      bootstrap_servers => "localhost:9092"
      codec => json
      topic_id => 'error'
      id => 'kafka_error'
    }
  } else {
    elasticsearch {
      hosts => ["http://localhost:9200"]
      manage_template => false
      index => "%{project}-%{type}-%{+YYYY.MM.dd}"
      id => 'elasticsearch'
      document_id => "%{[fingerprint]}"
    }
  }
}

However, this does not seem to work as the logs are being sent to both outputs at the same time. How can i possibly fix/debug this ? Thank you!

[magnusbaeck (Magnus Bäck)]

However, this does not seem to work as the logs are being sent to both outputs at the same time.

That's impossible with the configuration you've shown us. I think you have another configuration file somewhere. Perhaps an old backup file or something in /etc/logstash/conf.d or wherever your configuration files reside?