Removing fields for certain outputs

Elastic Stack Logstash
1

Hi there

I want to process certain log data using logstash and then pipe it to multiple outputs.
The data I wish to process always contains sensitive fields that I wish to send to some of the outputs and remove for others.

This is the gist of what I'm trying to do:

output {
  elasticsearch {
     # the whole event
  }
  rabbitmq {
     # the whole event MINUS the sensitive fields
  }

  # other outputs (some of them receive all of the event fields and some of them receive everything except the sensitive fields)
  # ...
}

I can see that is it's possible to remove the field for all of the outputs, but I only want to do that for some of them. Is this possible in a single configuration?

2

I have seen this requested before and a workaround for this is to create one event per output using the clone filter and then format these separately and send them to the correct output using conditionals. It is not terribly elegant but usually works.

3

Yeah, that seems to work pretty well. Thanks for the tip!