Conditional statement ignored in output module

I'm having an issues with Logstash 7.2.1 where conditional statements within the output module are being ignored.

Example, I made up [blahblahblah], so it is empty.

output {
  elasticsearch {
    id => "output_elasticsearch_prod"
    hosts => [ "http://${ES_1}", "http://${ES_2}", "http://${ES_3}" , "http://${ES_4}" , "http://${ES_5}", "http://${ES_6}" ]
    index => "flow_prod"
    template => "${ELASTIFLOW_TEMPLATE_PATH:/home/udocker/flowproc/elastiflow/templates}/flow.template.json"
    template_name => "flow"
    template_overwrite => "true"
  }

  if [blahblahblah] {
    elasticsearch {
      id => "output_elasticsearch_remote"
      hosts => [ "http://${ES_REMOTE_1}", "http://${ES_REMOTE_2}", "http://${ES_REMOTE_3}" , "http://${ES_REMOTE_4}" , "http://${ES_REMOTE_5}", "http://${ES_REMOTE_6}" ]
      index => "flow_remote"
      template => "${ELASTIFLOW_TEMPLATE_PATH:/home/udocker/flowproc/elastiflow/templates}/flow.remote.template.json"
      template_name => "flow_remote"
      template_overwrite => "true"
    }
  }
}

However I still get this error when logstash starts

Oct 02 18:30:35 opusinftest1-wbu2 flowproc_staging[88992]: getUniqueInterfaces failed. err: elastic: Error 503 (Service Unavailable)[2019-10-02T18:30:35,438][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Cannot evaluate `${ES_REMOTE_1}`. Replacement variable `ES_REMOTE_1` is not defined in a Logstash secret store or as an Environment entry and there is no default value given.", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:50:in `block in replace_placeholders'", "org/jruby/RubyString.java:3060:in `gsub'", "/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:35:in `replace_placeholders'", "/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:23:in `deep_replace'", "/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:20:in `block in deep_replace'", "org/jruby/RubyArray.java:1855:in `each_index'", "/usr/share/logstash/logstash-core/lib/logstash/util/substitution_variables.rb:19:in `deep_replace'", "/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:83:in `block in config_init'", "org/jruby/RubyHash.java:1419:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:82:in `config_init'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:60:in `initialize'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:232:in `initialize'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:48:in `initialize'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:30:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:242:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:140:in `buildOutput'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/usr/share/logstash/logstas

I've tried several different combinations of this with no luck. Is there something I missed or am doing wrong? The docs suggest this should work.

1 Like

An elasticsearch output establishes a connection during startup, it is not initialized when an event that would use it arrives.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.