Check the target object of a local_lookup for jdbc_static

Elastic Stack Logstash
1

How would I check to see if the local_lookup found the host name in the following conf snip. I tried an if statement just before the add_fields but logstash did not like that.

if [device] {...} = Expected one of [ \t\r\n], "#", "=>" at line 60, column 10 (byte 2963) after filter

  if "ovo_processing_failed" not in [tags] {
    jdbc_static {
      loaders => [
        {
          id => "gps-devices"
          query => "select id, ip, hostname, country, site, type, city from a_gps_device order by id"
          local_table => "devices"
        }
      ]
      local_db_objects => [
        {
          name => "devices"
          index_columns => ["id"]
          columns => [
            ["id", "bigint"],
            ["ip", "varchar(255)"],
            ["hostname", "varchar(255)"],
            ["country", "varchar(255)"],
            ["site", "varchar(255)"],
            ["type", "varchar(255)"],
            ["city", "varchar(255)"]
          ]
        }
      ]
      local_lookups => [
        {
          id => "local_devices"
          query => "SELECT ip, country, site, type, city from devices WHERE hostname = :name"
          parameters => {name => "[a_device_hostname]"}
          target => "device"
        }
      ]

      add_field => { a_device_ip => "%{[device][0][ip]}" }
      add_field => { a_device_country => "%{[device][0][country]}" }
      add_field => { a_device_site => "%{[device][0][site]}" }
      add_field => { a_device_type => "%{[device][0][type]}" }
      add_field => { a_device_city => "%{[device][0][city]}" }

      staging_directory => "C:/logstash-7.8.0/local_data"
      loader_schedule => "0 0 * * *" # run loaders every day midnight UTC
      jdbc_user => "xxxx"
      jdbc_password => "xxxx"
      jdbc_driver_class => "com.mysql.jdbc.Driver"
      jdbc_driver_library => "C:/logstash-7.8.0/drivers/mysql-connector-java-8.0.21.jar"
      jdbc_connection_string => "jdbc:mysql://xxxxx"
    }
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "static-test02"
  }
}
2

You cannot use a conditional inside a filter. It has to be between filters.

3

Thanks Badger. I worked the condition outside the filter. Had to use two filters for both conditions but you do what you have to.

if "host_ip_fail" in [tags] {
   jdbc_static {
     filter 01
   }
}
else {
    jdbc_satic {
        filter 02
   }
}
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.