CODEWITHSUNDEEP
elasticsearchlogstashlogstash-configurationlogstash-jdbc
Jacky0312
Jacky0312

Reputation: 28

How to use the field returned by sql for logstash if statement

Sql statement 

statement => "select ref_id,index_name,type,content from t_backup_es_data where backup_id >= :sql_last_value"

The value of the returned type column has a proposal and quotation

if[%{type}] == "quotation" {
        elasticsearch {
            hosts => "localhost:9200"
            index => "%{index_name}"
            document_type => "%{type}"
            document_id => "%{ref_id}"
            manage_template => true
            template_overwrite => true
            template => "../config/quotationMapping.json"
        }   
    }else if[%{type}] == "proposal" {
        elasticsearch {
            hosts => "localhost:9200"
            index => "%{index_name}"
            document_type => "%{type}"
            document_id => "%{ref_id}"
            manage_template => true
            template_overwrite => true
            template => "../config/proposalMapping.json"
        }
    }

This configuration does not working, what advice do you have?

Upvotes: 0

Views: 368

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

Assuming you're using the JDBC input plugin, the doc states:

Columns in the resultset are converted into fields in the event

I'd start with a stdout output and see what you have. The ELK stack has used 'type' as an internal field in the past, so it might be as simple as renaming the column in your query.

Upvotes: 0

Related Questions