# 'T' data from logstash

**URL:** <https://discuss.elastic.co/t/t-data-from-logstash/73004>\
**Category:** Logstash\
**Created:** [January 27, 2017, 11:07am UTC](https://discuss.elastic.co/t/t-data-from-logstash/73004 "2017-01-27T11:07:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alistair\_Hardy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alistair_hardy/32/16182_2.png) [@Alistair\_Hardy](https://discuss.elastic.co/u/Alistair_Hardy)\
**Post date:** [January 27, 2017, 11:07am UTC](https://discuss.elastic.co/t/t-data-from-logstash/73004/1 "2017-01-27T11:07:20Z")

</div>

Morning all  
I've been asked setup the elastic stack for the systems we ship. Though for now it's possibly outside the scope of what I've been asked to do, is it possible to take info from metricbeat and effectively T it to two different places?  
One one site and takes everything, the other off site which has much of the identifiable infomation filtered out.  
Thanks  
Alistair

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 27, 2017, 12:09pm UTC](https://discuss.elastic.co/t/t-data-from-logstash/73004/2 "2017-01-27T12:09:48Z")

</div>

You can use a clone filter to splice the input stream in two. The first half goes to one output and the other half gets filtered and is sent to another output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2017, 12:10pm UTC](https://discuss.elastic.co/t/t-data-from-logstash/73004/3 "2017-02-24T12:10:06Z")

</div>

Closed on February 24, 2017, 12:10pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.