Logstash microsoft-sentinel-logstash-output-plugin

[shadu88 (Shadab)]

Hello ELKs,
Hope you doing well!!
has anyone tried IF ELSE condition in "microsoft-sentinel-logstash-output-plugin" output logstash plugin?
I'm trying to forward the logs based on log source type to respective DCR endpoint.

Any leads or reference will be appreciated !
thank You!!

[Badger]

There is an example of a conditional around (not in) an output here.

[shadu88 (Shadab)]

Hello @magnusbaeck,

Thank you for your response.

Here is my config:
output {
if [message] =~ "MSWinEventLog" {
microsoft-sentinel-logstash-output-plugin {
client_app_Id => "abc"
client_app_secret => "xyz"
tenant_id => "qaz"
data_collection_endpoint => "rty"
dcr_immutable_id => "nmo"
dcr_stream_name => "Custom-SecurityEventStream"
}
}
else if [message] =~ "junos@" {
microsoft-sentinel-logstash-output-plugin {
client_app_Id => "abc"
client_app_secret => "xyz"
tenant_id => "qaz"
data_collection_endpoint => "rty"
dcr_immutable_id => "nm"
dcr_stream_name => "Custom-CommonSecurityLogStream"

    }

}
else {
microsoft-sentinel-logstash-output-plugin {
client_app_Id => "abc"
client_app_secret => "xyz"
tenant_id => "qaz"
data_collection_endpoint => "rty"
dcr_immutable_id => "nmo"
dcr_stream_name => "Custom-SyslogStream"

     }

}
}