I'm tagging my cloudflare data in the http_poller input in logstash. I have the following config in my output file, but the cf section is getting skipped and going right to the last stanza, writing the wrong index name
output {
if "azeh" in [tags] {
if [AppEnvironment] {
elasticsearch {
index => "tn-%{AppEnvironment}-%{LoggerName}-%{+YYYY.MM.dd}"
hosts => ["10.10.9.4:9200"]
}
}
else {
elasticsearch {
index => "tn-%{LoggerName}-%{+YYYY.MM.dd}"
hosts => ["10.10.9.4:9200"]
}
}
}else if "cloudflare" in [tags] {
elasticsearch {
index => "cloudflare-%{+YYYY.MM.dd}"
hosts => ["10.10.9.4:9200"]
}
}else {
elasticsearch {
hosts => ["10.10.9.4:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
}
the output in elasticsearch can be seen here:
All other tag-based index renames are working, save for this one.
Please advise.
Thank you