I would like to send logs to multiple hosts in the output plugin of logstash. Is there a way I can filter logs for each output separately using the filter plugin?
Thanks in advance
I would like to send logs to multiple hosts in the output plugin of logstash. Is there a way I can filter logs for each output separately using the filter plugin?
Thanks in advance
Yes you can send events to multiple or different elasticsearch host based on some criteria.
You would do it the following way:
Sample pipeline
input{
# some input plugin, e.g. "beats"
}
filter{
# some filter(s), e.g. "mutate", "grok", "date"
}
output{
# send event to an elasticsearch host based on the value of field "foo"
if [foo] == "bar"{
elasticsearch{
hosts => ["http://bar.com:9200"]
...
}
}
else if [foo] == "bazz"{
elasticsearch{
hosts => ["http://bazz.com:9200"]
...
}
}
else{
elasticsearch{
hosts => ["http://foo.bar.bazz.com:9200"]
...
}
}
}
I hope I could help you!
input
, thefilter
and theoutput
, you can only use output plugins inside theoutput
block. Why would you want to use anoutput
plugin inside thefilter
block? There is no reason for it.