Conditional Index Value in output

I was looking at this and trying to work in conditional logic on my pipeline.conf output so that if a given field exists, the index with have one values, and otherwise it will default to another value.

I currently have something like this:
output {
elasticsearch {
hosts => [ "<host_name>:<port_number>"]
index => "logstash-%{+YYYY.MM}"
}
}

I've tried a few different things, but keep getting something like:
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 53, column 11 (byte 758) after output

What does the complete configuration look like, and is that the complete error message?

That's the message. The full config looks like this:

input {
http {
}
}

filter {

json {
    source => "message"
}

mutate {
    rename => ["_duration", "duration"]
}

mutate {

    convert => {

...
several conversions
...
}

}

mutate {
    remove_field => ["headers", "message"]
}

}

output {
elasticsearch {
hosts => [ "hostName:portNumber"]
index => "logstash-%{+YYYY.MM}"
}
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.