The final stage of the event pipeline with an "if" statement

Elastic Stack Logstash
1

Hi there,

I'd like to know if adding a if..else statement to an output section will mean that only events that match the "if" branch will be finalized and sent to the output?

I'd like to match only specific events/logs and have anything that isn't matched in the if {} section of the output flow through to further filters and finally another output down the line.

Basically I'll be cloning the event with the clone filter plugin, and then the first output will look something like this:

output {
  if "cloned" in [tags] {
    redis {
      host => "redis:6379"
      data_type => "list"
      key => "logstash-cloned"
    }
  }
}

Later on in the pipeline I'll have an input that reads from the redis 'logstash-cloned' list, and a different filter and output to process the 'cloned' tagged stuff differently.

Is this feasible?

2

Yes. That will only send events that have the cloned tag to that output.

3

Great, thanks for confirming that. I'll put this into a test setup now and give it a whirl.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.