Conditions with environment variables

[Loulou]

Hi,
I am trying to have a different input for filebeat if a certain environment variable is set:

- type: log
  enabled: ${VAR}
  paths:
    - MyPath1
- type: log
  enabled: not ${VAR}
  paths:
    - MyPath2

I know the code will not work but basically when I set VAR to true I would like to have the first input and when it is set to false I would like the second output, is it possible this way?
I also looked into Define processors | Filebeat Reference [7.14] | Elastic but I did not find any information about conditions with environment variables..

If you have an idea of what I could do that would be great, thanks!

[mtojek (Marcin Tojek)]

I'm wondering if you can use this feature: [Elastic Agent] Support EQL condition on an input · Issue #20784 · elastic/beats · GitHub

[Loulou]

I tried it but unfortunately it's not working, I think it is for Elastic Agent but does not work for filebeat agent

[Loulou]

I found a solution that works, don't know if it's the best but at least it's functional:

- type: log
  enabled: true
  paths:
    - MyPath1
  fields:
    path2: ${MYPATH2:empty}
  processors:
    - drop_event:
       when.not.equals.fields.path2: "empty"
    - drop_fields:
       fields: ["path2"]
- type: log
  enabled: true
  paths:
    - ${MYPATH2:empty}

So basically if the path for the second event is set, then it is not empty so you can drop the first event. And if the path is not set then it is equal to empty, the first event is not dropped but the second one won't have a relevant path, so no data to fetch