Multiple Outputs In Logstash

Elastic Stack Logstash
1

Hi all,

Is it possible to have a conditional output in logstash?

My setup is several different filters in /etc/logstash/conf.d with grok filters.

They all then look at my output.conf file.

In my output.conf file I send the logs to an AWS SQS queue.

Output config:

if "_grokparsefailure" in [tags] {
        output {
         sqs {
            queue => "Queue-One"
            region => "eu-west-1"

            access_key_id => "xxx"
            secret_access_key => "xxx"
            }
          }
        }
        else {
         output {
           sqs {
           queue => "Other-Queue"
            region => "eu-west-1"

            access_key_id => "xxx"
            secret_access_key => "xxx"
          }
        }
     }

But this doesn't seem to work.

I have also tried

if [tags] =~ /grokparsefailure/ {

That also doesn't seem to work.

The error I get is:

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 833, column 1 (byte 58775) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:incompile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:inblock in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:incompile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:inblock in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:insynchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:inexecute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in block in converge_state'"]}

Any ideas?

2

That should be

output {
      if "_grokparsefailure" in [tags] {
          sqs { ... }
      } else {
          sqs { ... }
      }
}
1 Like
3

Cheers Mr @Badger

All sorted now!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.