Different Message data on Elastich and Output

#1

Hi,
I have this need. Using Graylog I have some logs (managed with pipeline/extractor etc).
Then I send these messages to kakfa output.

Now I need to reduce Message data before it is written on Elastic, but I need it (complete) for my output.
Is this possible?

Thanks
Gianluca

#2

Currently you can only output what is written to Elasticsearch - so no difference is possible.

#3

Thanks.
So can you tell me if is possible to exclude Elastic write operation instead?

#4

you can only drop messages - that is currently the only given option.

#5

Thanks.
If I drop messages in some pipeline, I will lose it in the output, isn’t it?

#6

If I drop messages in some pipeline, I will lose it in the output, isn’t it?

correct

#7

So there is no way to exclude data in ElasticSearch but send it in my output

#8

that is what I already have written.

2 Likes
#9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.