I want to take one input, do some filters, send output to one ES index, do more filters, then send to a second ES index.
The result should be one index with a set of fields, and the second index has a mostly different set of fields but based on the same original input.
In my logstash config, I tried input -> filter -> output -> filter -> output, where the second filter removes most fields and adds a few new ones before sending it to the second index, but the result is both indexes end up getting the combined filter result.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.