Index document to multiple indicies at once from logstash

Question

So I have no issues with indexing a record from logstash, however I want to be able to index the same record to multiple indicies.

Currently in my logstash output i have this:

output{
     elasticsearch {
        hosts => ["myHost"]
        user => "myUser"
        password => "myPassword"
        cacert => "myCert.pem"
        index => "myIndex_primary"
        document_id => "12345"
        action => "update"
        doc_as_upsert => true
        manage_template => false
    }
}

Lets say I also wanted to save the same record to a 'secondary' index. Is this possible from the same elasticsearch or would have be forces to duplicate the entire elasticsearch call?

My thought would be something like:

output{
    elasticsearch {
        hosts => ["myHost"]
        user => "myUser"
        password => "myPassword"
        cacert => "myCert.pem"
        index => ["myIndex_primary", "myIndex_secondary"]
        document_id => "12345"
        action => "update"
        doc_as_upsert => true
        manage_template => false
   }
}

Answer 1

Yes, this is possible. You need to add another elasticsearch output to the configuration file. The index option expects a string, not an array.

So your pipeline's output section would look like this:

output{
    elasticsearch {
        hosts => ["myHost"]
        user => "myUser"
        password => "myPassword"
        cacert => "myCert.pem"
        index => "myIndex_primary"   <--- index 1
        document_id => "12345"
        action => "update"
        doc_as_upsert => true
        manage_template => false
   }

   elasticsearch {
        hosts => ["myHost"]
        user => "myUser"
        password => "myPassword"
        cacert => "myCert.pem"
        index => "myIndex_secondary"   <--- index 2
        document_id => "12345"
        action => "update"
        doc_as_upsert => true
        manage_template => false
   }
}

I hope I could help you.