Multiple inputs in logstash

[vikramaddagulla]

Hello,

We are currently running filebeats and sending the data to logstash and that is working fine.

We are now working on a new set up which need to connect to an Oracle Database and get data from a table.

I understand this will need the jdbc plugin.

I would like to know if this can be achieved in the current config file ?? If yes, how ???

Or does it need a new config file for logstash ? If yes how can I run two different config files in a single logstash instance ?

Below is my scenario :

Current Config File looks like below :

input {
    # Your input config
}

filter {
    # Your filter logic
}

output {
    # Your output config
}

Expected : Does the below expected pattern work ?

input {
    beats {
        type => "beats_events"
        # Add rest of beats config
    }
    jdbc {
        type => "jdbc_events"
        # Add rest of jdbc config
    }
}

filter {
    if [type] == "beats_events" {
        # Add beats event filter logic
    }

    if [type] == "jdbc_events" {
        # Add jdbc event filter logic
    }
}

output {
    if [type] == "beats_events" {
        # Add beats event output config
    }
    if [type] == "jdbc_events" {
        # Add jdbc event output config
    }
}

[tamilsweet (Tamilmozhi Gunasekar)]

Yes. You can use if ... else if...

filter {
    if [type] == "beats_events" {
        # Add beats event filter logic
    } else if [type] == "jdbc_events" {
        # Add jdbc event filter logic
    }
}

output {
    if [type] == "beats_events" {
        # Add beats event output config
    } else if [type] == "jdbc_events" {
        # Add jdbc event output config
    } else {
        # Add the unknown event output config - store it in separate index to see why you have some unknown events.
    }
}