[closed]Logstash output with "else-if" not working

(Larry G Wapnitsky ) #1

I'm tagging my cloudflare data in the http_poller input in logstash. I have the following config in my output file, but the cf section is getting skipped and going right to the last stanza, writing the wrong index name

output {
if "azeh" in [tags] {
if [AppEnvironment] {
elasticsearch {
index => "tn-%{AppEnvironment}-%{LoggerName}-%{+YYYY.MM.dd}"
hosts => ["10.10.9.4:9200"]
}
}
else {
elasticsearch {
index => "tn-%{LoggerName}-%{+YYYY.MM.dd}"
hosts => ["10.10.9.4:9200"]
}
}
}

else if "cloudflare" in [tags] {
elasticsearch {
index => "cloudflare-%{+YYYY.MM.dd}"
hosts => ["10.10.9.4:9200"]
}
}

else {
elasticsearch {
hosts => ["10.10.9.4:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
}

the output in elasticsearch can be seen here:

All other tag-based index renames are working, save for this one.

Please advise.

Thank you

(Larry G Wapnitsky ) #2

Nevermind - rouge process was stealing/overwriting my configs. all working now

(system) closed #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.