# Logstash Multi Output and selective Information

**URL:** https://discuss.elastic.co/t/logstash-multi-output-and-selective-information/304431
**Category:** Elasticsearch
**Created:** [May 11, 2022, 8:25am UTC](https://discuss.elastic.co/t/logstash-multi-output-and-selective-information/304431 "2022-05-11T08:25:40Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)
#### Post date: [May 11, 2022, 8:25am UTC](https://discuss.elastic.co/t/logstash-multi-output-and-selective-information/304431/1 "2022-05-11T08:25:40Z")

</div>

input {  
http {  
host =\> "0.0.0.0" # default: 0.0.0.0  
port =\> 0000 # default: 8080

}  
}

filter {  
urldecode {  
all\_fields =\> true  
}  
}

```
filter {
   mutate { gsub => ["message", "\]", "}", "message", "\[", "{"] }
   kv { field_split => "&" allow_empty_values => true }

```

}

filter {  
mutate {

```
    rename => { "campaign{name}" => 'campaign_name' }
    rename => { "campaign{id}" => 'campaign_id' }
    rename => { "contact{first_name}" => 'contact_first_name' }
    rename => { "campaign{recipients}" => 'campaign_recipients' }

```

}  
}

filter {  
mutate {

```
   split => { "campaign_name" => '+' }
   split => { "campaign_id" => '+' }
   split => { "message" => '+' }
   split => { "contacti_ip" => '+' }
   split => { "contact_first_name" => '+' }
   split => { "campaign_recipients" => '+' }
   split => { "date_time" => '+' }

```

}  
}

filter {  
mutate {

```
   join => { "campaign_name" => " " }
   join => { "campaign_id" => " " }
   join => { "contacti_ip" => " " }
   join => { "contact_first_name" => " " }
   join => { "campaign_recipients" => " " }
   join => { "date_time" => " " }

```

}  
}

output {  
Elasticsearch {  
hosts =\> ['es:9200']  
#ssl =\> "true"  
#ssl\_certificate\_verification =\> "false"  
#ecs\_compatibility =\> disabled  
#manage\_template =\> false  
index =\> "test"

}  
stdout {  
codec =\> "json"  
}  
}

output {  
google\_bigquery {  
project\_id =\> "id\_09"  
dataset =\> "database"  
table\_prefix =\> "table"  
csv\_schema =\> "campaign\_name:STRING,timestamp:TIMESTAMP,date\_time:DATETIME,campaign\_id:STRING,account\_id:STRING,type:STRING"  
json\_key\_file =\> "/key/key.json"  
error\_directory =\> "/tmp/bigquery-errors"  
#date\_pattern =\> "activecapmain"  
ignore\_unknown\_values =\> true  
flush\_interval\_secs =\> 30  
}  
}

**Hello Every one My Above Pipe line is working now I want to all input in to Elasticsearch and selective feilds output want to add in google bigquery any Idea How can I achive that**

**and second thing in my http input I am getting urlencoded data so I used decode option to remove &% kindof signs but now I want to to remove every filed {} replacing with \_ it is acceptable in to bigquery but I have to right big code can any one suggest smart solution for this**

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 8, 2022, 8:26am UTC](https://discuss.elastic.co/t/logstash-multi-output-and-selective-information/304431/2 "2022-06-08T08:26:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
