Pipelines.yml distributor pattern more than 1 pipeline same events

Elastic Stack Logstash
1

Hello all,

this is my pipelines.yml file and is working really fine

- pipeline.id: distributor
  config.string: |
    input { beats { port => 5044 } }

    output {
        if "pc1" in [tags] {
          pipeline { send_to => proccess_1 }
        } else if "pc2" in [tags] {
          pipeline { send_to => proccess_2 }
        } else {
          # do nothing
        }
    }

- pipeline.id: proccess_1
  path.config: "/usr/share/logstash/pipeline/logstash-pipeline-1.conf"
- pipeline.id: proccess_2
  path.config: "/usr/share/logstash/pipeline/logstash-pipeline-2.conf"

how can apply more than one pipeline to the same tag events? for example, when pc1 events arrives from filebeat, besides sending it to

- pipeline.id: proccess_1
  path.config: "/usr/share/logstash/pipeline/logstash-pipeline-1.conf"

I would like to two different pipelines :

- pipeline.id: proccess_1
  path.config: "/usr/share/logstash/pipeline/logstash-pipeline-1.conf"
  path.config: "/usr/share/logstash/pipeline/logstash-pipeline-1-b.conf"

Is that posible?

Regards

2

If you want to send an event to multiple pipelines then you would use

    if "pc1" in [tags] {
      pipeline { send_to => [ "proccess_1", "process_1b" }
      ...

If you want a single pipeline to include multiple configuration files you would use

- pipeline.id: proccess_1
  path.config: "/usr/share/logstash/pipeline/logstash-pipeline-1*.conf"
3

Thanks Badger!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.