Conditionals with nested fields in logstash not working

[darlin]

Hi,

somehow when we use the input http plugin afterwards the conditionals with nested fields are not working. I've already tried with a non nested field and then it is working.

With the below configuration the request will be sent to elasticsearch instead of the businessobjects pipeline

HTTP Input Pipeline

    input {
  http {
    port => 8080
  }
}

output {
  if [log][message] =~ ".*BO.*" {
    pipeline {
      send_to => "businessobjects"
    }
  }
  else {
    elasticsearch {
   ....
   }
  }
  stdout { codec => rubydebug }
}

JSON Body of Request

    {
   "log.message":"BO Data is published",
}

I hope anyone can help!
Thank you
Darlin

[Badger]

@darlin

"log.message":"BO Data is published"

That would be [log.message]

[log][message] would be used if the JSON were

{ "log": { "message": "BO Data is published" } }

[darlin]

Thank you! Now it's working!