# Where to have logic to run everytime a new event occurs

**URL:** <https://discuss.elastic.co/t/where-to-have-logic-to-run-everytime-a-new-event-occurs/81662>\
**Category:** Logstash\
**Created:** [April 7, 2017, 8:34pm UTC](https://discuss.elastic.co/t/where-to-have-logic-to-run-everytime-a-new-event-occurs/81662 "2017-04-07T20:34:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shabirmean](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@shabirmean](https://discuss.elastic.co/u/shabirmean)\
**Post date:** [April 7, 2017, 8:34pm UTC](https://discuss.elastic.co/t/where-to-have-logic-to-run-everytime-a-new-event-occurs/81662/1 "2017-04-07T20:34:32Z")

</div>

Hi,

I'm writing a new input plugin. I have a need to run some logic everytime a new event is captured by Logstash.  
Based on the outcome of the logic I want to decide whether the event will be further processed or will it be dropped.

Ex: say with file input plugin - I want to do some validation on the new file and based on it I want to allow it to be processed or terminated.

For this where do I write my logic?? I tried in the **run(queue)** method but seems like it is only run at the initiation of the input plugin.

Shabir

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 10, 2017, 5:35am UTC](https://discuss.elastic.co/t/where-to-have-logic-to-run-everytime-a-new-event-occurs/81662/2 "2017-04-10T05:35:38Z")

</div>

Are you sure you want to do this in an input plugin? It sounds like you want to write a filter plugin that e.g. sets a tag if the event matches your set of conditions. Then you can add a conditional that checks for that tag and drops the event if there's a match. You could drop the event from your filter too but that's less flexible.

---

<div class="post-metadata">

**Author:** ![shabirmean](https://avatars.discourse-cdn.com/v4/letter/s/e5b9ba/32.png) [@shabirmean](https://discuss.elastic.co/u/shabirmean)\
**Post date:** [April 10, 2017, 1:30pm UTC](https://discuss.elastic.co/t/where-to-have-logic-to-run-everytime-a-new-event-occurs/81662/3 "2017-04-10T13:30:01Z")

</div>

Hi,

To be more specific what I'm trying to do is to validate every new file that's dropped for processing by the **logstash-input-file** plugin.

How I do this is I calculate the MD5 of the new file and call an endpoint to check whether it's a valid checksum. For this, I have added a new param to the input plugin called **auth-endpoint**.

So whenever a new file is detected, the MD5 digest of it is calculated and the endpoint above is called with this MD5 to check if it's a valid file.

I have explained what I have done here: [https://github.com/elastic/logstash/issues/6895](https://github.com/elastic/logstash/issues/6895)

However, I need more advice as to what I have done is correct? Is it possible to achieve what I have described with filters, the way you had explained? If so can you give me a more concrete example?

I am very new to logstash.

Shabir

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2017, 1:35pm UTC](https://discuss.elastic.co/t/where-to-have-logic-to-run-everytime-a-new-event-occurs/81662/4 "2017-05-08T13:35:31Z")

</div>

Closed on May 8, 2017, 1:35pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.