1

Here is my Logstash input log file:

{"timestamp":"2019-10-18T16:37:53.137068+0800","flow_id":1072393101531249,"in_iface":"eno1","event_type":"event A"}
{"timestamp":"2019-10-18T16:37:53.137069+0800","flow_id":1072393101531249,"in_iface":"eno1","event_type":"event B"}

Now I want to output these logs to different kafka topics(topic.A and topic.B) based on different event_type. Here is my current Logstash configuration:

input {
  file {
    path => "/data/*.json"
  }
}
filter {

}
output {
  kafka {
    codec => plain {
      format => "%{message}"
    }
    topic_id => "topic.A"
    ...
  }
}

How can I do what I want in logstash filter and output?

S4kur4
  • 11
  • 1
  • Use [conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) in your output, for example, `if [event_type] == "event A" { output to kafka topic a }` – leandrojmp Oct 18 '19 at 12:53
  • @leandrojmp You solved my confusion and I have implemented the function I want. Thank you very much. – S4kur4 Oct 21 '19 at 05:47

0 Answers0