logstash - can you forward logs to different targets for different log classes?

Question

I know in logstash you can forward logs.

Can you use different targets and protocol for different classes? I want to separate the forwarding target between my json and syslog logs. How do I do that?

question from:https://stackoverflow.com/questions/66051546/can-you-forward-logs-to-different-targets-for-different-log-classes

Answer 1

You can separate different flows as per their needs using tags and apply operations to them accordingly. A sample code is mentioned below:

 input {
      beats { port => 2200  tag => apache   }
      tcp { port => 9999  tag => firewall   }
    }
    filter {
       if "apache" in [tags] {  
        <someoperation> { ... }
       } else if "firewall" in [tags] {  
        grok { ... }
       }  
    }
    output {
       if "apache" in [tags] {  
        elasticsearch { ... }
       } else if "firewall" in [tags] {  
        tcp { ... }
       }  
    }

Explanation :

In the input plugin, all the events flowing from port 2200 and 9999 are added with tags apache and firewall respectively. This will be used to apply separate filter operations to each of the event based on the tag added in the input plugin. Now, In the same way these events can be separately sent to different or same endpoint (be it a log file, a console output, an Elasticsearch storage etc.)