Else if condition is not working?

Elastic Stack Logstash
1

I want if SubmittedOn is null then add New field with value 1 mutate{ add_field=>{"Queue"=>1} }

 if [SubmittedOn]{
        if [null] not in [SubmittedOn]{
            date {
                match => ["SubmittedOn", "MM/dd/yyyy hh:mm:ss a"]
                timezone => "+0500"
                target => "SubmittedOn"
            }
            ruby{
            init => "require 'time'"
            code => "event.set('SubmittedTimeInSeconds' , (event.get('SubmittedOn').to_i) - (event.get('ReceivedOn').to_i))"
            }
        }
        else if [null] in [SubmittedOn]{
            mutate{
                add_field=>{"Queue"=>1}
            }
        }
        else{
            ruby{
                code => "event.set('SubmittedTimeInSeconds' ,  0)"
            }
        }
    }
2

That is a test whether the contents of one field are in another (either an array membership test or a substring match).

I think you want

if [SubmittedOn] {
3

below this main if condition I have another if condition thats why I have used if [SubmittedOn ]{ then if else inside it.

4

Also in second if condition else if is not working

if [SubmittedOn]{
        if [null] not in [SubmittedOn]{
            date {
                match => ["SubmittedOn", "MM/dd/yyyy hh:mm:ss a"]
                timezone => "+0500"
                target => "SubmittedOn"
            }
            ruby{
            init => "require 'time'"
            code => "event.set('SubmittedTimeInSeconds' , (event.get('SubmittedOn').to_i) - (event.get('ReceivedOn').to_i))"
            }
        }
        else if [SubmittedOn] == [null]{
            mutate{
                add_field=>{"Queue"=>1}
            }
        }
        else{
            ruby{
                code => "event.set('SubmittedTimeInSeconds' ,  0)"
            }
        }
    }
    if [DeliveredOn]{
        if [null] not in [DeliveredOn]{
            date {
                match => ["DeliveredOn", "MM/dd/yyyy hh:mm:ss a"]
                timezone => "+0500"
                target => "DeliveredOn"
            }
            ruby{
                init => "require 'time'"
                code => "event.set('DeliveredTimeInSecondsTest' , (event.get('DeliveredOn').to_i) - (event.get('SubmittedOn').to_i))"
            }
            ruby{
                init => "require 'time'"
                code => "event.set('LoopBackTimeInSeconds' , (event.get('DeliveredOn').to_i) - (event.get('ReceivedOn').to_i))"
            }
        }
        else if (1==2){   
        }
        else{
            ruby{
                code => "event.set('DeliveredTimeInSecondsTest' ,  0)"
            }
            ruby{
                code => "event.set('LoopbackTimeInSeconds' ,  0)"
            }
        }
    }
5

When SubmittedOn is null then if condition working
if SubmittedOn is "" then through in error.

"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [DeliveredOn] of type [date] in document with id 'EE38C120-590C-41B8-8C5F'. Preview of field's value: ''", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"cannot parse empty date"}
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.