And operator in logstash output

Elastic Stack Logstash
1

I am sending JSON logs to logstash. Amongst the fields, there are two I am looking for -

[records][LogicalServerName]
[records][category]

I wrote an output like such -

else if [records][LogicalServerName] == "servername" and [records][category] == "DatabaseWaitStatistics"
{
elasticsearch {
hosts => ["http://my_elastic_ip:my_elastic_port"]
index => "myindex-dbwaitstatistics-%{+YYYY.MM.dd}"
user => "user"
password => "pass"
}
}

I am seeing the logs get sent to logstash successfully, but in Kibana, I keep trying to create the index, but it doesn't appear there is one. I verified the fields and triple checked. Also, the function to send the logs is working for another index, but I did not try the 'and' operator with that.

What could be the issue?

2

And what does an example document look like? Use a stdout { codec => rubydebug } output.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.