# SQS Output Plugin Data Mapping

**URL:** <https://discuss.elastic.co/t/sqs-output-plugin-data-mapping/79236>\
**Category:** Logstash\
**Created:** [March 20, 2017, 11:02am UTC](https://discuss.elastic.co/t/sqs-output-plugin-data-mapping/79236 "2017-03-20T11:02:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Samarth\_Prabhu](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Samarth\_Prabhu](https://discuss.elastic.co/u/Samarth_Prabhu)\
**Post date:** [March 20, 2017, 11:02am UTC](https://discuss.elastic.co/t/sqs-output-plugin-data-mapping/79236/1 "2017-03-20T11:02:50Z")

</div>

Does the SQS output plugin allow me to write only select data which was filtered in my "filter" plugin?

I would like to illustrate my question with a simple example :

A) My application produces logs as follows :  
2016-07-11T23:56:42.000+00:00 INFO [MySecretApp.com.Transaction.Manager]:Starting transaction for session -464410bf-37bf-475a-afc0-498e0199f008

B) I have a filter plugin which parses the log message :  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:log-level} [%{DATA:class}]:%{GREEDYDATA:rest\_of\_message}" }  
}

C) The filter Matches as follows :  
{  
"rest\_of\_message" =\> "Starting transaction for session -464410bf-37bf-475a-afc0-498e0199f008",  
"timestamp" =\> "2016-07-11T23:56:42.000+00:00",  
"log-level" =\> "INFO",  
"class" =\> "MySecretApp.com.Transaction.Manager"  
}

D) I want to send only the "rest\_of\_message" field to the SQS. Is this possible?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 21, 2017, 6:23am UTC](https://discuss.elastic.co/t/sqs-output-plugin-data-mapping/79236/2 "2017-03-21T06:23:22Z")

</div>

No, but you can use the clone filter to clone events and trim down one of the copies and send that to the sqs output and the rest to whatever other outputs you have.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2017, 6:23am UTC](https://discuss.elastic.co/t/sqs-output-plugin-data-mapping/79236/3 "2017-04-18T06:23:31Z")

</div>

Closed on April 18, 2017, 6:23am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.