Comparing fields from input

I have brought a json document from the index "sequence". I want to access one of the fields "value1" in that doc and compare.
I am getting errors.
My config file is -->

input {
elasticsearch {
hosts => "localhost:9200"
index => "sequence"
tags => "booleans"

filter {
mutate {
if "value1" == "true" {
# some operation .......
output {
if "bools" in [tags] {
stdout { codec => rubydebug }

Can anyone tell me how can I do the comparison??
Thank you in advance !!

"value1" refers to a string literal. To reference a field on an event use [value1]. "true" is also a string literal, if the field is actually a boolean then you should use

if [value1] == true {

Thanks that worked !!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.