Multiple Pipeline Output

[justinainsworth]

Continuing the discussion from Multiple outputs?:

According to this post, events can pass to multiple outputs. Is that the case when output is another pipeline? Or more specifically, if all conditionals are met, can an event be output to multiple pipelines?

output {
  
  if "OUTPUT_FILE" in [tags] {
    pipeline {
      id => "pl_900_f_event_output_routing => pl_912_o_identified"	
      send_to => "pl_912_o_identified"
    }
  }  
  if "_grokparsefailure " in [tags] {
    pipeline {
      id => "pl_900_f_event_output_routing => pl_913_o_grokfailure"	
      send_to => "pl_913_o_grokfailure"
    }
  }  
  
  if "OUTPUT_AZURE_SENTINEL_CEF " in [tags] {
    pipeline {
      id => "pl_900_f_event_output_routing => pl_921_o_azure_sentinel"	
      send_to => "pl_921_o_azure_sentinel"
    }
  } 
  if "OUTPUT_CASLC_ASA " in [tags] {
    pipeline {
      id => "pl_900_f_event_output_routing => pl_922_o_caslc_asa"	
      send_to => "pl_922_o_caslc_asa"
    }
  } 
  if "OUTPUT_CASLC_MERAKI " in [tags] {
    pipeline {
      id => "pl_900_f_event_output_routing => pl_923_o_acaslc_meraki"	
      send_to => "pl_923_o_acaslc_meraki"
    }
  } 
  
  if "OUTPUT_UNIDENTIFIED" in [tags] {
    pipeline {
      id => "pl_900_f_event_output_routing => pl_911_o_unidentified"	
      send_to => "pl_911_o_unidentified"
    }
  }
}

Events that are tagged "OUTPUT_FILE" properly output, but nothing else.

[Badger]

@justinainsworth

if all conditionals are met, can an event be output to multiple pipelines?

Yes.

You know you have trailing spaces in most of those tags, right?

"OUTPUT_CASLC_MERAKI "

[justinainsworth]

@Badger, I had stared at that config for a while, and I never noticed the trailing spaces. /)_-)

That was it. Thanks.