Conditional mutate not working

Elastic Stack Logstash
1

I am logging to more than one ports using syslog plugin.

However the following conditional filter does not work (although logs are received in more than one port as expected.

Any suggestions?

input {
  tcp {
    port => 5151
    type => syslog
  }
  tcp {
    port => 5152
    type => syslog
  }
}


filter {
    if [port] == 5151 {
        mutate {
            add_field => {'received_from' => 'service1'}
        }
    }
    if [port] == 5152 {
        mutate {
            add_field => {'received_from' => 'service2'}
        }
    }
}


output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}
2

The tcp input doesn't create a port field on incoming events, but you can configure it to add such a field by putting an add_field declaration in each tcp input.

3

Many thanks, now it works (no need for filter I guess):

input {
  tcp {
    port => 5151
    type => syslog
    add_field => {'received_from' => 'service1'}
  }
  tcp {
    port => 5152
    type => syslog
    add_field => {'received_from' => 'service2'}
  }
}

output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.