Hi,
When would you use a codec in your output?
I have a remote logstash instance outputting data to a file with gzip compression. The compressed file will be sent to a storage server from which the main logstash is reading before sending the data to Elastic.
Example remote site:
Input
Codec: netflow
filter
do some things
output
file
codec (would be JSON I guess)
Main logstash server
input
file
filter
do something
output
elastic
Would it make sense to have the remote site output formatted with the netflow codec and will that actually work? I don't understand when you'd want to use an output codec to re-encode your data and what the effect is when you use filters to edit the data as I assume that means it doesn't match codec templates anymore.
output