Condition statements output Logstash

Elastic Stack Logstash
1

Hello,

I'm working on possibilities to have many output in logstash.
I actually don't understand what is wrong.

I have 7.x versions.

If i just use this, it's working.

Blockquote
output {
if "ERRORLOG" in [tags] {
elasticsearch {
hosts => ["http://sta-elasticsearch:9200"]
index => "errorlog-%{+YYYY.MM.dd}"
}
}
Blockquote

But if i have more statements like this, i have errors in logstash

Blockquote
output {
if "ERRORLOG" in [tags] {
elasticsearch {
hosts => ["http://sta-elasticsearch:9200"]
index => "errorlog-%{+YYYY.MM.dd}"
}
}
else if "FDLAUNCHERRORLOG" in [tags] {
elasticsearch {
hosts => ["http://sta-elasticsearch:9200"]
index => "fdlauncherrorlog-%{+YYYY.MM.dd}"
}
}
else "SQLAGENT" in [tags] {
elasticsearch {
hosts => ["http://sta-elasticsearch:9200"]
index => "sqlagent-%{+YYYY.MM.dd}"
}
}
}
Blockquote

Error:

Blockquote
[2020-04-23T15:06:26,168][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:stalog-mssql, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, if, { at line 27, column 8 (byte 773) after output {\n if "ERRORLOG" in [tags] {\n elasticsearch {\n hosts => ["http://sta-elasticsearch:9200"]\n index => "errorlog-%{+YYYY.MM.dd}"\n }\n}\n else if "FDLAUNCHERRORLOG" in [tags] {\n elasticsearch {\n hosts => ["http://sta-elasticsearch:9200"]\n index => "fdlauncherrorlog-%{+YYYY.MM.dd}"\n }\n}\n else ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2584:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:26:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in block in converge_state'"]}
Blockquote

I thought it was a problem with indent but finally no.
What do think about that?

Regards.
Jonathan

2

That should be "else if", not just "else".

3

I will test. Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.