Work with multiples inputs/outputs in microsoft-logstash-output-azure-loganalytics plugin

Elastic Stack Logstash
1

I'm working with microsoft-logstash-output-azure-loganalytics plugin and have to receive different inputs and send to different output based on tags or port. Is is possible? Let's my config file:

input {
      tcp {
          port => "5014"
          type => syslog #optional, will effect log type in table
          tags => ["legacy1"]
      }
      tcp {
          port => "5015"
          type => syslog #optional, will effect log type in table
          tags => ["legacy2"]
      }

  }
  filter {
  }
  output {
        if "legacy1" in [tags] {

      microsoft-logstash-output-azure-loganalytics {
        workspace_id => "" # <your workspace id>
        workspace_key => "" # <your workspace key>
        custom_log_table_name => "tablelegacy1"
      }

}

        if "legacy2" in [tags] {

      microsoft-logstash-output-azure-loganalytics {
        workspace_id => "" # <your workspace id>
        workspace_key => "" # <your workspace key>
        custom_log_table_name => "tablelegacy2"
      }
    }

  }
2

Welcome to our community.

Yes, it's possible for both cases, tag or port. Here is a similar sample.

3

I did that simple test but only the first file was created.

Let's the code:

input {
      tcp {
          port => "30001"
          codec => "json"
          tags => "Teste1"
      }
      tcp {
          port => "30002"
          codec => "json"
          tags => "Teste2"
      }

  }
  filter {
  }

output {
     if "Teste1" in [tags] {
     file {
     path => "/tmp/Log_Teste1.log"
     }

     if "Teste2" in [tags] {
     file {
     path => "/tmp/Log_Teste2.log"
     }
   }
  }
}
4

Add to see your data. Use the command line to run LS, not service.

output {
stdout { codec => rubydebug{} }
...
}

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.