In logstash we have multiple sources of input data - so we use conditionals on a document field (doc_type
) to apply the various filters.
Is there any real difference or benefit between having one filter with conditionals inside vs having multiple filters where each filter starts with the conditional?
One filter
filter {
if [doc_type] == 'type1' {
grok { ...}
}
if [doc_type] == 'type2' {
grok { ...}
}
}
Multiple filters
filter {
if [doc_type] == 'type1' {
grok { ...}
}
}
filter {
if [doc_type] == 'type2' {
grok { ...}
}
}