same app logs to multiple destination based on types

[seasuresh]

I'm trying to identify how to route the same app logs messages to two different destination based on log message types. The app emits two types of logs.

1. Structured - Log message contains plain text 
2. Unstructured  - Log message contains plain text & JSON

I want to send the Structured logs to Kinesis stream and Unstructured logs to AWS CloudWatch. I'm using AWS Firelens with fluent-bit logDriver.I tried reading the docs but I don't seems find a good example to achieve this. Any help would be appreciate.

Example Log:

2022-07-16 02:44:07 [main] INFO  c.c.app.config.CacheConfig - Cache initialized successfully with duration:2400
2022-07-16 02:44:08 [main] INFO  c.c.app.config.DBConfig - DB connection is created
2022-07-16 02:44:09 [main] INFO  c.c.app.config.LogUtil - (()){"type":"messageLog", "status":"success", appName:"appConfigService"}

I want to send the 1st and 2nd log message to Cloud watch and 3rd log message to Kinesis Stream. Any suggestion or example would be a great help!

[patrick-stephens]

@seasuresh this looks like the same as I think what was answered here in Slack: https://fluent-all.slack.com/archives/C0CTQGHKJ/p1658309226994999?thread_ts=1658026401.198069&cid=C0CTQGHKJ

Is that right? Be good to respond with a final config or similar for anyone finding this.

EDIT: For those without Slack:

Here is full config. We split our logs to land on two different destinations
1. Unstructured logs to CloudWatch with multi line support
2. Structured logs to Kinesis

[SERVICE]
    parsers_file parser.conf
    Flush 1
[FILTER]
    Name                  multiline
    Match                 myApp*
    multiline.parser      java
    multiline.key_content log
[FILTER]
    Name                  parser
    Match                 *
    Parser                simple
    key_name              log
    Preserve_Key          On
    Reserve_Data          On
[FILTER]
    Name                  rewrite_tag
    Match                 myApp*
    Rule                  $type (tLog) tLOG false
    Emitter_Name          re_emitted
[OUTPUT]
    Name                  kinesis
    Match                 tLOG*
    region                us-east-2
    stream                myStream
    http_request_timeout  15
    data_keys             log
    compression           gzip
    retry_limit           3
[OUTPUT]
    Name                  cloudwatch
    Match                 myApp*
    region                us-west-2
    log_group_name        myApp-cw-log
    log_stream_prefix     fl

[seasuresh]

Yes, that's correct. Thanks @patrick-stephens