One input to multiple outputs with different transforms

Elastic Stack Logstash
1

Hey there, pretty sure this can be done but just want to get some direction.

I need Logstash to take in one input and transform it in 2 different ways to end up in 2 different outputs.

I know I can use two outputs just not clear on the transform part and how to massage the data in two different ways before getting to the outputs.

Is this what the clone of the split is for?

Any examples would be helpful. Thanks so much.

Jen

2

Assuming you have a reasonably modern version of logstash, I would run one pipeline that did no filtering (or just filtering needed for both outputs) then unconditionally write to two outputs, each of which would be consumed by another pipeline that performed the output specific filtering.

You might want to look at pipeline-to-pipeline links for this, or you can use tcp or http to communicate between pipelines.

3

Interesting...checked out the link and it appears this is the newer (better) way to handle the forked path pattern. They even say it used to be done with Ifs and Clone which is where I was going.

Thanks much...will definitely be checking this out...seems like the way to go.

Jen

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.