Hi,
I have following fields in my event:
...
"stage": [
"shared",
"QA",
"dev_trunk"
],
...
I want to set a new meta field to to staging, if the stage filed contains, QA, dev_trunk or PreProd.
I have tried with following sniplet:
# process the stage
if [stage] == "Production"
{
mutate
{
add_field => { "[@metadata][indexCluster]" => "prod" }
}
}
#elseif [stage] in ["QA", "dev_trunk", "PreProd"]
elseif "QA" in [stage] or "dev_trunk in [stage] or "PreProd" in [stage]
{
mutate
{
add_field => { "[@metadata][indexCluster]" => "staging" }
}
}
else
{
mutate
{
add_field => { "[@metadata][indexCluster]" => "no_stage_defined" }
}
}
The event above is resulting in "no_stage_defined".
How can I correct this?
I am using logstash 5.2.0
Thanks, Andreas