Need to send index to 2 ES from Logstash

[Loudone]

Hello All,

I'm currently trying to send index from logstash to 2 Elasticsearch cluster like below:

the problem is, in output logstash's section, it's possible to set in Hosts two ES cluster, but in loadbalance mode.

So, my first question is : is it possible to set two HOSTS line in the logstash's output section?

My second question is: if not for the 1st question, is it possible to make rules with tags for set two logstash's output?

Thank's for your help

[Christian_Dahlqvist]

To send to two different clusters you need to setup two separate Elasticsearch outputs.

[Loudone]

First of all, Many thanks for your feed back Christian.

Do you mean I can do that for example:

output {
if "foo_1" in [tags] {
elasticsearch {
hosts => ["ES1"]
index => "foo_1-%{+YYYY.MM.dd}"
}
}
else if "foo_2" in [tags] {
elasticsearch {
hosts => ["ES1"]
index => "foo_2-%{+YYYY.MM.dd}"
}
}
else {
elasticsearch {
hosts => ["ES1"]
index => "other_foo-%{+YYYY.MM.dd}"
}
}
}
output {
if "foo_1" in [tags] {
elasticsearch {
hosts => ["ES2"]
index => "foo_1-%{+YYYY.MM.dd}"
}
}
else if "foo_2" in [tags] {
elasticsearch {
hosts => ["ES2"]
index => "foo_2-%{+YYYY.MM.dd}"
}
}
else {
elasticsearch {
hosts => ["ES2"]
index => "other_foo-%{+YYYY.MM.dd}"
}
}
}

Thank you

[Christian_Dahlqvist]

Yes, but you can put it all within a single output block.

[Loudone]

Ok Great!! Thank you Christian.