Logstash pipeline to pipeline - send_to field variable

Elastic Stack Logstash
1

Hello,

I am working on the use of pipeline-to-pipeline. I wanted to value a variable and then use it in send_to of the pipeline plugin.

idea to avoid the use of several if..else conditions which surely have an impact on the performance of logstash.

but unfortunately, the field fails to be valued once in the send_to.

input {

      # ESB blablabla
    stdin {}
}
filter {
    grok { match => {"message" => "%{WORD:appTrigrammeCible}%{SPACE}%{GREEDYDATA:other}"}}
    mutate {
        
        add_field => {
            "[@metedata][output_id]" => "%{}" # OK
        }
    }
}

output {
    pipeline {
        send_to => [ %{[@metedata][output_id]} ]
    }
}

An idea ?

2

It is not possible, the send_to option does not support sprintf expansion, so it will try to output to a pipeline with the literal name of %{[metadata][output_id]}.

You will need to use the if else conditions, but I don't think this will have any considerable impact in the performance.

I do not have any benchmarks about this case, but I've run pipelines with many if/else conditions in the output without any impact, a single grok filter probably has more impact in the performance than many simple conditionals check.

3

Thanks for your return. I think I'll combine the if..else.