Dynamic index names

I've lifted the below pattern from the logstash docs and modified for my use case.

Deffo have a field service.region in my log messages that is populated with values dev1 dev2 or sit. But i am not seeing the indexes with [service][region] pattern being created.

Looking at debug logs it seems that my if statement seems always to drop to else clause .

Using ELK 7.12.0

What am I doing wrong ?

filter {
# we don't want these to go to the application log indexes
    if [service][region] in [ "dev1","dev2","sit" ] {
        mutate {
            add_field => { "[@metadata][target_index]" => "blade-logs-%{[service][region]}-%{+YYYY.MM.dd}" }
        }
    } else {
        mutate {
            add_field => { "[@metadata][target_index]" => "blade-logs-%{+YYYY.MM.dd}" } }
    }
    mutate {
        rename => {
            "message.index" => "message_index"
        }
    }
}

foo

output {
    elasticsearch {
        ....
        index => "%{[@metadata][target_index]}"
        ilm_enabled => false
    }
}

I get the logic around ILM managed indexes and naming as mentioned in previous answers.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.