Send to multiple elasticsearch index with different fields

I have log like this:

"info":"just for search",
"response": {
"code": 200,
"status": ok,
"cmd": "login"

and I want to send the total log into index A for text search, and send only the code/status/cmd to another index B for aggregation。

so, how to do this?

You need to use a clone filter to split each event in two. Then use different filters on each copy of the message and send them to different outputs.

what is clone filter? means two filter in one config file?

Ok, I have already know what is clone . Thank you !

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.