# Logstash json ouput choose keys and values

**URL:** <https://discuss.elastic.co/t/logstash-json-ouput-choose-keys-and-values/190546>\
**Category:** Logstash\
**Created:** [July 15, 2019, 1:36pm UTC](https://discuss.elastic.co/t/logstash-json-ouput-choose-keys-and-values/190546 "2019-07-15T13:36:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sous\_Lesquels](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sous_lesquels/32/41843_2.png) [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\
**Post date:** [July 15, 2019, 1:36pm UTC](https://discuss.elastic.co/t/logstash-json-ouput-choose-keys-and-values/190546/1 "2019-07-15T13:36:00Z")

</div>

Say I have a pipeline that writes events to two files. Both files should be in json format, but they should have different fields from the event and in a different format.

For example, say the event is like this:

```
{"a": 1.3, "b": "Jul 15 2019", "c": false, "d": "cn4339b371"}

```

I might want to store these two jsons in two separate files:

```
{"b1": "07/15/2019", "d": "cn4339b371"}
{"a": 1.3, "b2": "20190715", "c": false, "d": "cn4339b371"}

```

where key b goes to b1 and b2 and are formatted differently and a & c are dropped from the first file.

Is there an example of how this can be done with logstash that I can look into?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2019, 3:19pm UTC](https://discuss.elastic.co/t/logstash-json-ouput-choose-keys-and-values/190546/2 "2019-07-15T15:19:05Z")

</div>

I suggest you look at the [forked path](https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html#forked-path-pattern) pattern for pipeline to pipeline communication.

---

<div class="post-metadata">

**Author:** ![Sous\_Lesquels](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sous_lesquels/32/41843_2.png) [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\
**Post date:** [July 15, 2019, 4:10pm UTC](https://discuss.elastic.co/t/logstash-json-ouput-choose-keys-and-values/190546/3 "2019-07-15T16:10:12Z")

</div>

Thanks Badger - I'll look into it. However, right now we're starting one logstash instance and specifying `path.config`. I.e. we're sharing the settings, thus `pipeline.yml` as well between different instances, so this will be problematic to implement. Is it possible to do this within one pipeline in order to preserve this setup? Or should we consider splitting this up into multiple instances? Or other suggestions?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2019, 4:19pm UTC](https://discuss.elastic.co/t/logstash-json-ouput-choose-keys-and-values/190546/4 "2019-07-15T16:19:46Z")

</div>

> [@Sous\_Lesquels](#):
>
> Is it possible to do this within one pipeline

The documentation for the forked path pattern mentions that it can be done in one pipeline 'through creative use of the `clone` filter and `if/else` rules'.

---

<div class="post-metadata">

**Author:** ![Sous\_Lesquels](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sous_lesquels/32/41843_2.png) [@Sous\_Lesquels](https://discuss.elastic.co/u/Sous_Lesquels)\
**Post date:** [July 15, 2019, 4:37pm UTC](https://discuss.elastic.co/t/logstash-json-ouput-choose-keys-and-values/190546/5 "2019-07-15T16:37:56Z")

</div>

Thanks Badger - I'll try that.

The other part of the question - any reference configs for how I can define output json fields from the event?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 12, 2019, 4:38pm UTC](https://discuss.elastic.co/t/logstash-json-ouput-choose-keys-and-values/190546/6 "2019-08-12T16:38:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.