CODEWITHSUNDEEP
logstashlogstash-configuration
Dave Challis
Dave Challis

Reputation: 3906

Conditionals or variables within a logstash block

Within some logstash configuration, I'd like to conditionally set the value of one field within a configuration block, without having to repeat the entire block.

So for example, I've got two http outputs with very similar settings:

output {
    if "foo" in [tags] {
        http {
            url => "http://example.com/x"
            http_method => "post"
            follow_redirects => true
            keepalive => false
            connect_timeout => 20
            cookies => true
        }
    } else {
        http {
            url => "http://example.com/y"
            http_method => "post"
            follow_redirects => true
            keepalive => false
            connect_timeout => 20
            cookies => true
        }
    }
}

what's the best way of avoiding repeating the content of those two blocks, and just changing the single field that I'm interested in? I was hoping I could either set a variable and use that within the block, or use an if within the block, but couldn't find an example of either.

I was looking for something like the following sort of thing (which is invalid configuration):

output {
    http {
        if "foo" in [tags] {
            url => "http://example.com/x"
        } else {
            url => "http://example.com/y"
        }
        http_method => "post"
        follow_redirects => true
        keepalive => false
        connect_timeout => 20
        cookies => true
    }
}

Upvotes: 1

Views: 251

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

Set a variable in your filter{} section (mutate->add_field, perhaps) and then refer to that variable in your output stanza, e.g.:

url => "%{myField}"

If you don't want to store the variable in elasticsearch, use metadata in both places, e.g.:

[@metadata][myField]

Upvotes: 2

Related Questions