Send to multiple elasticsearch index with different fields

Elastic Stack Logstash
1

I have log like this:

{
"info":"just for search",
"url":"123.234.123.234:8080/abc",
"response": {
"code": 200,
"status": ok,
"cmd": "login"
}
}

and I want to send the total log into index A for text search, and send only the code/status/cmd to another index B for aggregation。

so， how to do this?

2

You need to use a clone filter to split each event in two. Then use different filters on each copy of the message and send them to different outputs.

3

what is clone filter? means two filter in one config file?

4

Ok, I have already know what is clone . Thank you !

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.