I have the following use case:
Using Filebeat to tail a single log file. Based on the type of log entry detected I need to route the data to a different custom processor.
- Lines that start with A would be stored as is
- Lines that start with B would be pre-aggregated (count the number of lines of this type), then stored somewhere else
Note that I'm using Filebeat as a "go" library.
Currently what I'm doing is define a single prospector with multiple entries on "include_lines", then evaluate conditions on the Outlet to determine how to route the event.
Ideally I would be able to evaluate once instead of twice. Is that possible?