Elastic Logstash Input Filter and Output Example

Conditional-output.yaml

output {
    if [fieldName] == "stringA" {
        output for this type of message
    }
    if [fieldName] == "stringB" {
        output for this type of message
    }
    if [fieldName] == "stringN" {
        output for this type of message
    }
}

Elastic-Logstash-filter.yaml

input {
  file {
    path => "/usr/share/logstash/batch_10day.txt"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}

filter {
  csv {
      separator => ";"

      columns => ["status","date", "time", "workstation", "application", "job", "Error_code"]
  }
}

output {
csv {
    path => "/usr/share/logstash/batch_10day.csv"
    csv_options => {
        "write_headers" => true
    "headers" => ["status","date", "time", "workstation", "application", "job", "Error_code"]
}
    fields => ["status","date", "time", "workstation", "application", "job", "Error_code"]
 }
}

ouyput.yaml

output {
  elasticsearch {
     hosts => ["localhost:9200"]
         index => "logstash_index"
 }
  stdout {
    codec => rubydebug
 }
  csv {
    path => "path-to-file\syslogs-%{+yyyy.MM.dd}.csv"
    csv_options => {
        "write_headers" => true
    "headers" => ["timestamp", "message", "count"]
}
    fields => ["@timestamp", "message", "count"]
 }
}

simple-input-output.yaml

# foo.conf
input {
    file {
        path => "C:/logstash-2.3.1/logstash-tutorial-dataset"
        start_position => "beginning"
        ignore_older => 0  
    }
}
output {
    stdout {}
    file {
        path => "C:/output.txt"
    }
}