Comparing fields from input

Elastic Stack Logstash
1

I have brought a json document from the index "sequence". I want to access one of the fields "value1" in that doc and compare.
I am getting errors.
My config file is -->

<
input {
elasticsearch {
hosts => "localhost:9200"
index => "sequence"
tags => "booleans"
}
}

filter {
mutate {
if "value1" == "true" {
# some operation .......
}
}
}
output {
if "bools" in [tags] {
stdout { codec => rubydebug }
}
}
/>

Can anyone tell me how can I do the comparison??
Thank you in advance !!

2

"value1" refers to a string literal. To reference a field on an event use [value1]. "true" is also a string literal, if the field is actually a boolean then you should use

if [value1] == true {
3

Yes
Thanks that worked !!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.