Logstash Setting up multiple config files in one pipeline

Elastic Stack Logstash
2

If you have multiple configuration files for a single pipeline then they are combined. Events are read from all of the outputs, sent through all of the filters, and every event is written to every output. If you want each configuration file to be self contained then either run it in its own pipeline, or use (for example)

add_field => { "documentType" => "typeOne" }

on the input and then use

if [documentType] == "typeOne" {
    [...]
}

in the filter and output sections to make them conditional.

2 Likes