Im ussing LS 6.1 When i use condition in logstash, it not work. i dont know that why? I should be run into condition (True) instead of False. It not run in " if [nginx][access][remote_ip] { ... } " Sample log { "_index": "fb-fim-websites-2017.50", "_type": "doc", "_id": "vyPVYmABWfAqnld66a…

Try this filter { if [type] == "nginx-access" { grok { patterns_dir => ["/etc/logstash/patterns"] match => { "message" => "%{NGINXACCESS}" } match => { "message" => "%{NGINXACCESSCUSTOME}" } } if [nginx.access.remote_ip] { # Check if destination IP address…

Discuss the Elastic Stack

Access data event and field in logstash condition error

Elastic Stack Logstash

system (system) Closed January 14, 2018, 9:46am 12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Logstash condition match Logstash	5	3565	July 6, 2017
If conditional on nested field with IP address Logstash	10	3903	April 21, 2020
Conditionnal filter not recognize field Logstash	3	329	December 27, 2019
Clientip field is not identified by logstash (Solved) Logstash	12	4494	July 6, 2017
Can't make conditionnal filtering to work Logstash	7	1395	December 5, 2016

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Access data event and field in logstash condition error

Related topics