# Select fields for multiple outputs

**URL:** <https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531>\
**Category:** Logstash\
**Created:** [September 2, 2015, 2:28pm UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531 "2015-09-02T14:28:01Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![dyermakov](https://avatars.discourse-cdn.com/v4/letter/d/9d8465/32.png) [@dyermakov](https://discuss.elastic.co/u/dyermakov)\
**Post date:** [September 2, 2015, 2:28pm UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/1 "2015-09-02T14:28:01Z")

</div>

Hi all!  
I have a config:

```
input {
  rabbitmq {
    host => "x.x.x.x"
    port => 5672
    vhost => "/"
    user => "guest"
    password => "guest"
    queue => "yyyy"
    durable => true
    codec => "es_bulk"
  }
}
filter {
  mutate {
    remove_field => ["@version", "@timestamp"]
  }
}
output {
  elasticsearch {
    protocol => "http"
    host => "x.x.x.x"
    port => 9200
    cluster => "test_cluster"
    action => "%{[@metadata][action]}"
    document_id => "%{[@metadata][_id]}"
    document_type => "%{[@metadata][_type]}"
    index => "%{[@metadata][_index]}"
  }
  stdout {
    codec => rubydebug { metadata => true }
  }
}

```

The input data is something like:

```
{"index":{"_index":"data","_type":"en","_id":1}}
{"Text":"text1","Language":"en","Date":"2015-09-02T00:00:00Z"}

```

On parse we get:

```
{
     "Language".[0;37m => .[0m.[0;33m"en".[0m,
         "Date".[0;37m => .[0m.[0;33m"2015-09-02T00:00:00Z".[0m,
         "Text".[0;37m => .[0m.[0;33m"text1".[0m,
    "@metadata".[0;37m => .[0m{
             "_index".[0;37m => .[0m.[0;33m"data".[0m,
              "_type".[0;37m => .[0m.[0;33m"en".[0m,
                "_id".[0;37m => .[0m.[1;34m1.[0m,
             "action".[0;37m => .[0m.[0;33m"index".[0m,
        "retry_count".[0;37m => .[0m.[1;34m0.[0m
    }
}

```

And now I'm stuck. I need send to "stdout" only field "Text". Can you help me to change my config to select to "stdout" output only "Text" field?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 2, 2015, 4:09pm UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/2 "2015-09-02T16:09:55Z")

</div>

Don't use the rubydebug codec. Use the plain codec or just omit that option. I believe you'll still get the timestamp (not sure if you can do anything about that) but you can use a simple sed filter or something to remove that.

---

<div class="post-metadata">

**Author:** ![dyermakov](https://avatars.discourse-cdn.com/v4/letter/d/9d8465/32.png) [@dyermakov](https://discuss.elastic.co/u/dyermakov)\
**Post date:** [September 2, 2015, 4:20pm UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/3 "2015-09-02T16:20:03Z")

</div>

"stdout" output with "rubydebug" codec is just for example. I'll use "rabbitmq" as second output with "json" codec. But I need to filter fields before sending data to that output.

I'd found the same question, but answer seems wrong:  
[[http://stackoverflow.com/questions/25156476/logstash-how-to-output-a-selection-of-fields](http://stackoverflow.com/questions/25156476/logstash-how-to-output-a-selection-of-fields)][1]  
[1]: [http://stackoverflow.com/questions/25156476/logstash-how-to-output-a-selection-of-fields](http://stackoverflow.com/questions/25156476/logstash-how-to-output-a-selection-of-fields)  
Please advice.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 2, 2015, 5:09pm UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/4 "2015-09-02T17:09:21Z")

</div>

Oh. There's no generic way of filtering what fields to send to a particular output.

---

<div class="post-metadata">

**Author:** ![dyermakov](https://avatars.discourse-cdn.com/v4/letter/d/9d8465/32.png) [@dyermakov](https://discuss.elastic.co/u/dyermakov)\
**Post date:** [September 2, 2015, 5:18pm UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/5 "2015-09-02T17:18:35Z")

</div>

Hm... So, the best way is try to modify output plugin to own need, right?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 2, 2015, 5:42pm UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/6 "2015-09-02T17:42:28Z")

</div>

Yes, or modify the base class for outputs to add a generic feature to filter the fields to include.

---

<div class="post-metadata">

**Author:** ![dyermakov](https://avatars.discourse-cdn.com/v4/letter/d/9d8465/32.png) [@dyermakov](https://discuss.elastic.co/u/dyermakov)\
**Post date:** [September 2, 2015, 6:09pm UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/7 "2015-09-02T18:09:15Z")

</div>

Understood, thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 4, 2015, 9:43am UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/8 "2015-09-04T09:43:42Z")

</div>

Relevant GitHub issue:

> <https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/218>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/select-fields-for-multiple-outputs/28531/9 "2017-07-06T05:30:04Z")

</div>