#logstash

can an output {} block go inside of a filter {} block or no?

ageis: nope

hrm ok so how do i have a conditional output (e.g. based on tags) instead of sending everything there?

oh, i can do if statements inside my output

heh

output { if condition { ...

yup

also note that it will try every output

so if you have two outputs with no conditions, you will get 2x the output

same if your condition matched two outputs

*matches

which means if you have conditional output, and another output with no condition, it will use both

and how would i specify which network interface the output uses?

ageis: not sure what you mean

the system should take care of that for you

so there's no setting for it

why would you want to do that?

yeah i guess it will use the default route

let's say i have firewall rules or a private network ?

you would need to configure yournetworking at the OS level to take care of that

e.g., multiple interfaces and routes

if it's a network-based output you would just tell it to talk to whichever IP, and your local routing will do the rest

hi all. i've setup ELK 6.3 stack. i've been trying to process nginx logs with request_time and upstream_response_time but i couldn't succeed. any suggestions?

HI Guys, wondering if anyone could help me out with this one...

Intalled logstash 6.3 from repo on centos 7.5

did a bin/logstash-plugin install logstash-filter-prune, which installed successfully, I can see package in installed list

but still getting errors when trying to use it...

[2018-07-04T15:59:47,491][ERROR][logstash.plugins.registry] Tried to load a plugin's code, but failed. {:exception=>#<LoadError: no such file to load -- logstash/filters/prune>, :path=>"logstash/filters/prune", :type=>"filter", :name=>"prune"}

any help would be massively appreciated

would be useful if somewhere in the documentation it would say that after installation of a plugin you need a restart of the logstash service.

thanks for the fish