Closed niteshjain closed 4 weeks ago
This kind of feature, in my opinion, belongs in the codec (output { tcp { codec => .... } }
). I'm open to discussion, though :)
You can also remove fields (or create new events from existing events) in filters. Can you tell me a story why the tcp
output needs this feature and why you might not want to do this with filters?
So my logstash config looks like this:
input { tcp {...} } filter { csv { separator => "." } } output { elasticsearch {...} tcp { ... fields => ["column1"] } }
The listener for the tcp output is only interested in certain fields.
This might be a very specific use case though.
23