CODEWITHSUNDEEP
logstash
Evan Gertis
Evan Gertis

Reputation: 2052

How to check for an index with a date in logstash output

I have an output like so:

output {
  if [target_index]   == "mystream-%{+YYYY.MM.dd}"{
    kinesis {
      stream_name => "mystream"
      region => "us-east-1"
    }
  }

I'd like to filter by the index pattern mystream-{date}. For some reason this conditional is not working. I'm not sure what the problem is here. Any help would be greatly appreciated.

Upvotes: 0

Views: 104

Answers (1)

Badger
Badger

Reputation: 4072

Values compared in conditionals are not sprintf'd. You would have to use mutate to add a value that gets sprintf'd, and then compare to that. For example

filter { mutate { add_field => { "[@metadata][streamName]" => "mystream-%{+YYYY.MM.dd}" } } }
output {
    if [target_index] == [@metadata][streamName] { ...

Upvotes: 1

Related Questions