Conditional statement ignored in output module

Elastic Stack Logstash
1

I'm having an issues with Logstash 7.2.1 where conditional statements within the output module are being ignored.

Example, I made up [blahblahblah], so it is empty.

output {
  elasticsearch {
    id => "output_elasticsearch_prod"
    hosts => [ "http://${ES_1}", "http://${ES_2}", "http://${ES_3}" , "http://${ES_4}" , "http://${ES_5}", "http://${ES_6}" ]
    index => "flow_prod"
    template => "${ELASTIFLOW_TEMPLATE_PATH:/home/udocker/flowproc/elastiflow/templates}/flow.template.json"
    template_name => "flow"
    template_overwrite => "true"
  }

  if [blahblahblah] {
    elasticsearch {
      id => "output_elasticsearch_remote"
      hosts => [ "http://${ES_REMOTE_1}", "http://${ES_REMOTE_2}", "http://${ES_REMOTE_3}" , "http://${ES_REMOTE_4}" , "http://${ES_REMOTE_5}", "http://${ES_REMOTE_6}" ]
      index => "flow_remote"
      template => "${ELASTIFLOW_TEMPLATE_PATH:/home/udocker/flowproc/elastiflow/templates}/flow.remote.template.json"
      template_name => "flow_remote"
      template_overwrite => "true"
    }
  }
}

However I still get this error when logstash starts

Oct 02 18:30:35 opusinftest1-wbu2 flowproc_staging[88992]: getUniqueInterfaces failed. err: elastic: Error 503 (Service Unavailable)[2019-10-02T18:30:35,438][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Cannot evaluate `${ES_REMOTE_1}`. Replacement variable `ES_REMOTE_1` is not defined in a Logstash secret store or as an Environment entry and there is no default value given.", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:50:in `block in replace_placeholders'", "org/jruby/RubyString.java:3060:in `gsub'", "/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:35:in `replace_placeholders'", "/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:23:in `deep_replace'", "/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:20:in `block in deep_replace'", "org/jruby/RubyArray.java:1855:in `each_index'", "/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:19:in `deep_replace'", "/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:83:in `block in config_init'", "org/jruby/RubyHash.java:1419:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:82:in `config_init'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:60:in `initialize'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:232:in `initialize'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:48:in `initialize'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:30:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:242:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:140:in `buildOutput'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstas

I've tried several different combinations of this with no luck. Is there something I missed or am doing wrong? The docs suggest this should work.

1 Like
2

An elasticsearch output establishes a connection during startup, it is not initialized when an event that would use it arrives.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.