Hi All,
I have written filter in logstash and placed them in logstash conf.d directory and i have set same index but different document type for elasticsearch output of each filter.But when I have run query in elasticsearch i found output of 1st doument type is stored in 2nd document type.It mixing output .Please provide solution as soon as possible.
Logstash has a single event pipeline. Just because you split your configuration into multiple files doesn't mean that events generated by inputs in one file only reaches filters and outputs in the same file. If you don't want that you need to add conditionals around your filters and outputs.
This comes up here pretty often. You can find additional details in the archives.
Hi Thanks For Reply,its pretty helpful,
But I'm using jdbc plugin ,So I have written sql query in input using jdbc and configured its output in elasticsearch with particular document type for all the files. I am not able to figure out that how to put conditional over it for separating output.