LogStash with distributor pattern, relay pipelines problem

Elastic Stack Logstash
7

I don't think that the pipeline input has the codec option, it seems to have only the send_to and address options.

You will need to filter for some string in the message since you can't parse the message.

Something like this:

input {
    upd {
        port => 514
    }
}
output {
    if "localadmin" in [message] {
        pipeline { send_to => localadmin }
    } else if "passwordsyncrhonizer" in [message] { 
        pipeline { send_to => passwordsynchronizer }
    } other else if conditions
}

I would also suggest that you use pipelines.yml to only point to the configs, and have the configs in separated files.

For example, create a udp.conf file with the udp pipeline and just point to this file in the pipelines.yml file, having the configurations in the pipelines.yml can lead to confusion and mistake if your configuration grows.

- pipeline.id: udp
  path.config: "/etc/logstash/conf.d/udp.conf"
1 Like