5 Routing log events

So far in this book, we have seen how to capture and store log events. But in all the examples, routing was simply all events going to the same output. However, this can be far from ideal. As described in chapter 1, we may want log events to go to different tools, depending on the type of log event. It may be desirable to send a log event to multiple locations or none. In this chapter, we will, therefore, examine the different ways we can route events. In addition, we will look at some smaller features that can contribute to solving the challenges of routing, such as adding information into the log event to ensure the origin of the log event is not lost along the way.

5.1 Reaching multiple outputs by copying

5.1.1 Copy by reference or by value

5.1.2 Handling errors when copying

5.2 Configuration reuse and extension through inclusion

5.2.1 Place holding with null output

5.2.2 Putting inclusions with a MongoDB output into action

5.3 Injecting context into log events

5.3.1 Extraction of values

5.4 Tag-based routing

5.4.1 Using exec output plugin

5.4.2 Putting tag naming conventions into action

5.4.3 Putting dynamic tagging with extract into action

5.5 Tag plugins

5.6 Labels: Taking tags to a new level

5.6.1 Using a stdout filter to see what is happening