logstash 可以将数据同时发送到多个位置以及弹性搜索

Question

Normally, in ELK logstash parsed data and send to elastics search.

I want to know is it possible that logstash send same data to different location at real time.

If it is possible, please let me know how to do it.

Answer 1

Create several output files that match type and send to different hosts.

output {
  if [type] == "syslog" {
    elasticsearch {
          hosts => ["127.0.0.1:9200"]
          index => "logstash-%{+YYYY.MM.dd}"
          codec => "plain"
          workers => 1
          manage_template => true
          template_name => "logstash"
          template_overwrite => false
          flush_size => 100
          idle_flush_time => 1
    }
  }
}