elastic / logstash

Logstash - transport and process your logs, events, or other data
https://www.elastic.co/products/logstash
Other
14.18k stars 3.5k forks source link

sprintf pipeline to pipeline communications #16457

Open amitaiporat opened 1 week ago

amitaiporat commented 1 week ago

sprintf does not work for pipeline to pipeline communication in logstash. send_to block does not acknowledge sprintf formatted inputs.

For example, an ideal logstash output would look like the following:

output {
     pipeline { send_to => [@metadata][field]}
}

Because logstash send_to block does currently not recognize sprintf, must use conditional logic to wrap send_to block. A config must contain the following workaround.

output {
    if [@metadata][field] {
        if [@metadata][field] == "field_value" {
            pipeline { send_to => ["pipeline_name", "field_value", ...]}
    else {...}
}
yaauie commented 1 week ago

You are correct that the pipeline output's send_to does not support sprintf.

Due to the design of the pipeline bus, all destination pipeline addresses must be known to the output plugin at plugin registration (before pipeline startup). While dynamic routing may be possible at some point in the future, it would be exceptionally tricky to implement in a way that doesn't risk automating data-loss.