Conditional in the output is ignored

Elastic Stack Logstash
1

The conditional statement in my logstash configuration is being ignored. It is being skipped over no matter what I put in it. I have 4 elasticsearch options in the output divided by an if and else statement. I've tried using the following conditional statements:

if "tag_name" in [tags] {
elasticsearch {
.....
}
elasticsearch {
.......
}
} else {
elasticsearch {
.....
}
elasticsearch {
.......
}
}

I've also tried to use if [tags] == ["tag_name"].

I've it with incorrect values for the tag_name and somehow it still skips over and just drops into the first elasticsearch output.

2

I do not think that will ever match. See this issue.

What is the value of [tags] field in elasticsearch? Does it contain the tag you are testing?

3

It should not. The tags field should be empty. I'm using this config for two processes. I set tags in one but do not in add tags in the other. There actually shouldnt be any tags added. Either way there is no issue showing for if "tag_name" in [tags] even if tag_name is incorrect or if tags even exists as a field.

4

So I'm currently using 7.2.0 for logstash and Elasticsearch would removing the log4j class have anything to do with it?

5

I tried using the example in the linked issue and the "in" and "not in" syntax but still no success. There are actually no values for the tags field. For one index I add tags in the input but for the other index I do not add this line to the config. It seems to just skip over it. Whenever, I add a bad field or value no error or warning or anything, nothing comes up. Any ideas?

6

Could it be the way I run the config file. I just use /path/to/logstash -f /logstash/config/path. Are there other options I'm missing?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.