Logstash - Multiple outputs with different content

Elastic Stack Logstash
1

Hello,
I would like to achieve to have multiple outputs withing one pipeline but with different content of documents.

ONE PIPELINE

  • OUTPUT FOR CUSTOMER (REDIS QUEUE or LOGSTASH)
    • only one field: [@metadata][message][original] with some content
  • OUTPUT FOR INTERNAL PURPOSES (REDIS QUEUE or LOGSTASH)
    • message field
    • and additional fields e.g.: hostname, timestamp, event.category, environment.type

I cannot send for customer additional field, only field [@metadata][message][original].

Is it possible to do within one pipeline or is it necessary to use more pipelines for this use case?

2 
mutate {
  add_field => {"[@metadata][target]" => ["customer", "internal"]}
} 
split {
  field => "[@metadata][target]" 
}

And then use conditions like if [@metadata][target] == "customer" around the filters and outputs that are only meant for one of them.

1 Like
3

Thank you @Jenni. It is exactly what I'm looking for :wink:

4

It works like a charm :wink:

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.