Adding new field based on AND Condition

Elastic Stack Logstash
1

Hi have below coloumns

columns => [ "Order Key","Cust #","Doc Type","Doc #","Order #","Order Type","Order Complete?","Order Date","Total Order Value","Total Dollar Value","TotalOrderReceivedToday","Inv #","Inv Date","Expected Ship Date","Shipment Date","TotalShipped","ThisWeekShipped","Salesperson","Salesperson name","Loc","ThisWeekOrders"]

I want to add new field based on below condition, but it's not adding a new field.

if [Order Complete?] == "False" and [Doc Type] == "O" {
    mutate { add_field => { "Order Complete?" => "Open Unfilled Orders" } }
} else if [Order Complete?] == "True" and [Doc Type] == "I" {
    mutate { add_field => { "Order Complete?" => "Filled Orders" } }
}

Please help !

2

Can you show an example event using

output { stdout { codec => rubydebug } }
3

Thanks Badger looking into this, Below is the output

{
            "ThisWeekShipped" => 0,
                        "Loc" => " GS",
                   "@version" => "1",
             "ThisWeekOrders" => 0,
                       "path" => "D:/ELK/logstash-7.9.3/config/TotatOrderOfDay.csv",
                "Salesperson" => "   SPZ",
    "TotalOrderReceivedToday" => 0,
         "Expected Ship Date" => 2020-07-28T04:00:00.000Z,
                       "host" => "server",
                  "Order Key" => "I      462123",
                   "Doc Type" => "I",
               "TotalShipped" => 0,
                      "Doc #" => 462123,
                    "Order #" => 416622,
                     "Cust #" => 780,
            "Order Complete?" => true,
              "Shipment Date" => 2020-08-11T04:00:00.000Z,
                    "message" => "\"I      462123\",\"   780\",\"I\",\"      462123\",\"      416622\",\"O\",\"True\",28-Jul-20,420.2,474.83,0,\"      462123\",11-Aug-20,28-Jul-20,11-Aug-20,0,0,\"   SPZ\",\"Sheri Peet\",\" GS\",0\r",
                 "@timestamp" => 2020-12-17T18:03:33.478Z,
               "Order Status" => "AlreadyInvoiced",
         "Total Dollar Value" => 474.83,
                      "Inv #" => "      462123",
                 "Order Type" => "O",
           "Salesperson name" => "Sheren",
          "Total Order Value" => 420.2,
                   "Inv Date" => 2020-08-11T04:00:00.000Z,
                 "Order Date" => 2020-07-28T04:00:00.000Z
}
4

There are no quotes around the value true, so this is a boolean, not a string. Try

if ! [Order Complete?] and [Doc Type] == "O" {
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.