CODEWITHSUNDEEP
logstash
Evan Gertis
Evan Gertis

Reputation: 2052

Using a conditional in logstash

Has anyone ever added a conditional to an input? I'm using various versions of the beats plugin. Versions less than 7.11 don't have @metadata I'd like to use two different indicies conditionally. For example,

15    beats {
16         port => "5000"
17         codec => "plain"
18         ssl => true
19         ssl_certificate_authorities => ["/etc/pki/logstash/logstashCA.pem"]
20         ssl_certificate => "/etc/pki/logstash/logstashCA.pem"
21         ssl_key => "/etc/pki/logstash/logstashCA.p8"
22         ssl_verify_mode => "force_peer"
23         if [version] not in [beat] {
24                 add_field => { "target_index" => "%{[@metadata][beat]}-%{[beat]}-7-%{+YYYY.MM.dd}" }
25         }
26         add_field => { "target_index" => "%{[@metadata][beat]}-%{[beat][version]}-%{+YYYY.MM.dd}" }
27    }

Upvotes: 0

Views: 373

Answers (1)

Badger
Badger

Reputation: 4072

No, you cannot have a conditional based on fields of the event in an input because at the time the input is built no events exit. However you can do it in the filter section

if [beat][version] {
    add_field => { "target_index" => "%{[@metadata][beat]}-%{[beat][version]}-%{+YYYY.MM.dd}" }
} else {
    add_field => { "target_index" => "%{[@metadata][beat]}-%{[beat]}-7-%{+YYY
}

Upvotes: 3

Related Questions