Conditional(else if ) is not working in logstash(6.8.7) pipeline

Elastic Stack Logstash
1

Can you please help me to find out the issue of this pipeline.

filter{
    if [log_group] in  [ "/aws/lambda/dev", "/aws/lambda/dev-ful" ] {
        mutate { 
	          add_field => { "[@metadata][target_index]"  =>  "[dev]-%{+YYYY.MM.dd} }
	    } 
    } else if   [log_group] ==  "/aws/lambda/test"  {
		mutate { 
			add_field => { "[@metadata][target_index]" => "[test]-%{+YYYY.MM.dd}" } 
		}
   } else if  [log_group]  ==  "/aws/lambda/test-ful"  {
		mutate { 
	      add_field => { "[@metadata][target_index]" => "[test]-%{+YYYY.MM.dd}" } 
		}
   } else {
        mutate { 
	          add_field => { "[@metadata][target_index]" => "unknown-%{+YYYY}" } 
	    }
   }
}


Problem:

backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in `block in converge_state'"]}
2

What is the error message?

3

i found the issue, there is a typo here.I missed the double inverted comma in

"[@metadata][target_index]" => "[dev]-%{+YYYY.MM.dd}  here
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.