Logstash configuration with multiple destinations

logstash-pipeline.cfg

input {
    tcp {
        port => 514
        type => syslog
        host => "141.93.182.143"
        tags => ["gso_sentinel"]
    }
}
input {
    udp {
        port => 514
        type => syslog
        host => "141.93.182.143"
        queue_size => 16384
        workers => 4
        receive_buffer_bytes => 24576000
        codec => plain { charset => "ISO-8859-1" }
        tags => ["gso_sentinel"]
    }
}
input {
    tcp {
        port => 7514
        type => syslog
        mode => "server"
        host => "141.93.182.143"
        ssl_enable => true
        ssl_cert => "/apps1/log-jars/KPNCert/syslogserver.pem"
        ssl_key => "/apps1/log-jars/KPNCert/syslogserverkey.pem"
        ssl_certificate_authorities => [ "/apps1/log-jars/KPNCert/RootCA.pem" ]
        ssl_verify => true
        ssl_key_passphrase => "${CERT_PASS}"
        ssl_supported_protocols => ['TLSv1.1', 'TLSv1.2', 'TLSv1.3']
        tags => ["gso_sentinel"]
    }
}

filter {
    if ("gso_sentinel" in [tags]){
        mutate {
            add_field => { "Country" => "NL" }
            add_field => { "connector_host" => "hostname.domain.com" }
        }
        if ([host] == "17.93.180.49") or ([host] == "17.93.126.47") {
        mutate {
            add_field => { "sentinelTable" => "UX_rhlinux" }
        }
        }
        else if ([host] == "17.93.177.62") or ([host] == "17.93.178.219") or ([host] == "17.93.178.79") or ([host] == "17.93.126.92") or ([host] == "17.93.178.43")
        or ([host] == "17.93.125.114") or ([host] == "17.93.125.126") or ([host] == "17.93.126.40") or ([host] == "17.93.178.204") or ([host] == "17.93.178.205")
        or ([host] == "17.93.180.43") or ([host] == "17.93.125.149") or ([host] == "17.93.125.124") or ([host] == "17.93.179.215") or ([host] == "17.93.126.133")
        or ([host] == "17.93.188.100") or ([host] == "17.93.178.31") {
        mutate {
            add_field => { "sentinelTable" => "UX_aix" }
        }
        }
        else if ([host] == "17.93.177.61") {
        mutate {
            add_field => { "sentinelTable" => "UX_Hpunix" }
        }
        }
        else if ([host] == "17.93.125.39") or ([host] == "17.93.177.57") or ([host] == "10.16.3.24") or ([host] == "10.16.3.38") {
        mutate {
            add_field => { "sentinelTable" => "UX_Solaris" }
        }
        }
        else if ([host] == "10.16.128.30") {
        mutate {
            add_field => { "sentinelTable" => "AC_Aruba" }
        }
        }
        else {
        mutate {
            add_field => { "sentinelTable" => "New_SourcesAlert" }
        }
        }
        grok {
        keep_empty_captures => "true"
        match => { "@timestamp" => "%{YEAR:sys_year}-%{MONTHNUM:sys_month}-%{MONTHDAY:sys_day}%{GREEDYDATA}" }
        }
    }
}

output {
    if("gso_sentinel" in [tags]){
        if([sentinelTable] == "UX_rhlinux") {
            microsoft-logstash-output-azure-loganalytics {
                workspace_id => "${SENTINEL_ID}"
                workspace_key => "${SENTINEL_KEY}"
                proxy => "http://proxy.domain.com:8080"
                retransmission_time => 2
                plugin_flush_interval => 2
                custom_log_table_name => "UX_rhlinux"
            }
        }
    }
    else if([sentinelTable] == "UX_aix") {
        microsoft-logstash-output-azure-loganalytics {
            workspace_id => "${SENTINEL_ID}"
            workspace_key => "${SENTINEL_KEY}"
            proxy => "http://proxy.domain.com:8080"
            retransmission_time => 2
            plugin_flush_interval => 2
            custom_log_table_name => "UX_aix"
        }
    }
    else if([sentinelTable] == "UX_Hpunix") {
        microsoft-sentinel-logstash-output-plugin {
            client_app_Id => "<client_app_Id>"
            client_app_secret => "<client_app_secret>"
            tenant_id => "<tenant_id>"
            data_collection_endpoint => "https://dce-uri.westeurope-1.ingest.monitor.azure.com"
            dcr_immutable_id => "dcr-<id>"
            dcr_stream_name => "Custom-UX_Hpunix"
        }
    }
    else if([sentinelTable] == "UX_Solaris") {
        kusto {
            path => "/tmp/kusto/%{+YYYY-MM-dd-HH-mm-ss}.txt"
            ingest_url => "https://ingest-clustername.westeurope.kusto.windows.net"
            app_id => "<client_app_Id>"
            app_key=> "<client_app_secret>"
            app_tenant => "<tenant_id>"
            database => "logstash-archive"
            table => "Cisco_RO_CL"
            json_mapping => "UX_Solaris"
        }
    }
    else if([sentinelTable] == "AC_Aruba") {
        microsoft-sentinel-logstash-output-plugin {
            client_app_Id => "<client_app_Id>"
            client_app_secret => "<client_app_secret>"
            tenant_id => "<tenant_id>"
            data_collection_endpoint => "https://dce-uri.westeurope-1.ingest.monitor.azure.com"
            dcr_immutable_id => "dcr-<id>"
            dcr_stream_name => "Custom-AC_Aruba"
        }
    }
    else if([sentinelTable] == "New_SourcesAlert") {
        microsoft-logstash-output-azure-loganalytics {
            workspace_id => "${SENTINEL_ID}"
            workspace_key => "${SENTINEL_KEY}"
            proxy => "http://proxy.domain.com:8080"
            retransmission_time => 2
            plugin_flush_interval => 2
            custom_log_table_name => "New_SourcesAlert"
        }
    }
}