# Multiple Outputs In Logstash

**URL:** <https://discuss.elastic.co/t/multiple-outputs-in-logstash/177111>\
**Category:** Logstash\
**Created:** [April 16, 2019, 3:19pm UTC](https://discuss.elastic.co/t/multiple-outputs-in-logstash/177111 "2019-04-16T15:19:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [April 16, 2019, 3:19pm UTC](https://discuss.elastic.co/t/multiple-outputs-in-logstash/177111/1 "2019-04-16T15:19:04Z")

</div>

Hi all,

Is it possible to have a conditional output in logstash?

My setup is several different filters in /etc/logstash/conf.d with grok filters.

They all then look at my output.conf file.

In my output.conf file I send the logs to an AWS SQS queue.

Output config:

```
if "_grokparsefailure" in [tags] {
        output {
         sqs {
            queue => "Queue-One"
            region => "eu-west-1"

            access_key_id => "xxx"
            secret_access_key => "xxx"
            }
          }
        }
        else {
         output {
           sqs {
           queue => "Other-Queue"
            region => "eu-west-1"

            access_key_id => "xxx"
            secret_access_key => "xxx"
          }
        }
     }

```

But this doesn't seem to work.

I have also tried

`if [tags] =~ /grokparsefailure/ {`

That also doesn't seem to work.

The error I get is:

`Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 833, column 1 (byte 58775) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in`compile\_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in`block in compile\_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in`compile\_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in`block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in`synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in `block in converge_state'"]}`

Any ideas?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 16, 2019, 3:27pm UTC](https://discuss.elastic.co/t/multiple-outputs-in-logstash/177111/2 "2019-04-16T15:27:35Z")

</div>

> [@Jasonespo](#):
>
> if "\_grokparsefailure" in [tags] { output { sqs {

That should be

```
output {
      if "_grokparsefailure" in [tags] {
          sqs { ... }
      } else {
          sqs { ... }
      }
}

```

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [April 16, 2019, 3:36pm UTC](https://discuss.elastic.co/t/multiple-outputs-in-logstash/177111/3 "2019-04-16T15:36:02Z")

</div>

Cheers Mr @Badger

All sorted now!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2019, 3:36pm UTC](https://discuss.elastic.co/t/multiple-outputs-in-logstash/177111/4 "2019-05-14T15:36:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.