Logstash：拆分输出

Question

Is it possible to split output in the Logstash configuration? for example: I have input: logs: file1.log and file2.log wanted output:

1. redis-- easy to configure using docs..

2. %MyBigStorage%\\archive\\file1.log for file1.log content only

3. %MyBigStorage%\\archive\\file2.log for file2.log content only

and 1 more thing: is it possible configure it for folders?

Answer 1

Yes, you can split the output. Also, you can split the output by folder.

First, when you input the logs, you can define the type for each input.

input {
    file {
        path => "/path/to/first/folder/*"  # The * is tell logstash input all the log file in this directory
        type => "file1.log"
    }
    file {
        path => "/path/to/second/folder/*"  
        type => "file2.log"
    }
}

output {
    if [type] == "file1.log" {
         # output to XXX
    } else if [type] == "file2.log" {
         # output to YYY
    }
}

Hope this can help you.