Parse the same input in two different ways

Elastic Stack Logstash
1

Hello,

i have the following situation, i'm receiving logs from UDP port 6514 as the input for logstash, what i wanna do is apply two different filters to the same logs (parallely) and send them off to elasticsearch in two different indexes, something like:

                         Log Input 
                              |
                              |---------------------------------------------|
                              |                                             |
                         Filter A                                        Filter B
                              |                                             |
                              |                                             |
                          Index A                                        Index B

is it possible to do this in the same parser file? Could anyone show me a quick example?

Thanks in advance !

2

Have a look at the clone filter.

3

Yeah, that's what i needed! Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.