Environment variables in IF-statement

Elastic Stack Logstash
1

hi Everyone!

My goal is to 'implement' filter to process only traces with specific levels.
Perfect solution: levels should be defined in separated file or environment variable.

So, I would like to achive it in this way:
if [level] in [${MY_LEVEL_FILTER}] { ... // to some logic } else { drop {} }
For some reason above solution does not work correctly, nor:
if [level] == MY_LEVEL_OK_1 or [level] == MY_LEVEL_OK_2 {

Hard-coded IF-statement works:
if [level] in ["INFO", "ERROR"] { ... }

I have got Logstash 2.4. It works as a service with flag --allow-env
(So it is according to the documentation; and I have noted 'experimental' word)

This is what I did to make 'environemt variables' achievable:

  1. In /etc/init.d/logstash file I put
    export MY_LEVEL_FILTER='"INFO", "ERROR"' export MY_LEVEL_OK_1=INFO export MY_LEVEL_OK_2=ERROR

( just to make sure I call
sudo /opt/logstash/bin/logstash -f /etc/logstash/conf.d/mylogstash1.conf --configtest )
and I call:
sudo service logstash start

I have got some enviroment variables, e.g.:
MY_INPUT_FILE_NAME=/path/to-input-file MY_LEVEL_FILTER=["INFO", "WARN", "ERROR"]

Below example works perfectly fine:
input { file { path => "${MY_INPUT_FILE_NAME}" } }
What is more, in other plugin (in Ruby source code)
I have got: puts ENV['MY_LEVEL_FILTER']
which displays desired string.

Maybe ENV in Ruby source code is something else than in logstash configuration file?
Maybe above pieces of information will be useful for someone.
Thank you for helping.

2 
if [level] in [${MY_LEVEL_FILTER}] {

And you expect that if you set MY_LEVEL_FILTER to "a", "b", "c" that the line above would be equivalent to this?

if [level] in ["a", "b", "c"] {

That won't work. The variable expansion takes place later when Logstash has already parsed the configuration file.

I'd use a template language to generate the configuration files.

3

hi, thank you for your reply. I have implemented "workaround":
One step before I added certain fields based on environment variables and I used those fields in IF-statement. It works fine :slight_smile: