# Logstash thread model - workaround for multiple destinations

**URL:** <https://discuss.elastic.co/t/logstash-thread-model-workaround-for-multiple-destinations/218401>\
**Category:** Logstash\
**Created:** [February 7, 2020, 8:23pm UTC](https://discuss.elastic.co/t/logstash-thread-model-workaround-for-multiple-destinations/218401 "2020-02-07T20:23:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![g.le](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/g.le/32/22526_2.png) [@g.le](https://discuss.elastic.co/u/g.le)\
**Post date:** [February 7, 2020, 8:23pm UTC](https://discuss.elastic.co/t/logstash-thread-model-workaround-for-multiple-destinations/218401/1 "2020-02-07T20:23:24Z")

</div>

A while ago, I had created a [thread](https://discuss.elastic.co/t/if-else-within-logstash-output-plugin/185965) regarding cloned events and delivery to two distinct Elasticsearch **clusters**.

As it turned out, the thread model of Logstash does not guarantee delivery of an event to its proper output destination in case it was cloned as part of the filtering process.  
The solution suggested by @Christian_Dahlqvist was using [Logstash pipelines](https://www.elastic.co/guide/en/logstash/7.1/pipeline-to-pipeline.html).

How about the following workaround?

Config file: 1.beats\_to\_stdout

```
input {
  beats {
    port => 5044
    tags => ["beats"]
  }
}
filter {
  clone {
    clones => ["cloned"]
  }
}
output {
  stdout { codec => json }
}

```

Config file: 2.stdin\_to\_elasticsearch

```
input {
  stdin { }
}
filter {
  if "beats" not in [tags] { drop { } }
}
output {
  if "cloned" in [type] { elasticsearch { hosts => ["elastic-01.normal.site:9200"] } }
  else { elasticsearch { hosts => ["elastic-01.disaster.site:9200"] } }
}

```

In essence, we tag events coming from Beats, clone and push them to stdout.  
Then, we read events coming from stdin, drop the untagged ones and distribute them to the proper Elasticsearch cluster (based on the type).

Any thoughts?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2020, 8:23pm UTC](https://discuss.elastic.co/t/logstash-thread-model-workaround-for-multiple-destinations/218401/2 "2020-03-06T20:23:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.