Event field in logstash output

[Akaren]

Hi, in my logstash config in output part I have sns settings:

sns { region => "eu-west-1" arn => "xxxx" }

It works but every event has inside field called "SNSregion" that contains region (we get it from user gui...). So I need to put this field into sns settings. But both of ways doesn't work...

sns { region => [SNSregion] arn => "xxxx" }

sns { region => "%{SNSregion}" arn => "xxxx" }

It shows error:

[2018-01-16T10:13:08,497][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Something is wrong with your configuration."}
[2018-01-16T10:13:34,202][ERROR][logstash.outputs.sns ] Invalid setting for sns output plugin:

output {
sns {
# This setting must be a ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "eu-central-1", "eu-west-1", "eu-west-2", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ap-northeast-2", "sa-east-1", "us-gov-west-1", "cn-north-1", "ap-south-1", "ca-central-1"]
# Expected one of ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "eu-central-1", "eu-west-1", "eu-west-2", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ap-northeast-2", "sa-east-1", "us-gov-west-1", "cn-north-1", "ap-south-1", "ca-central-1"], got ["%{SNSregion}"]
region => "%{SNSregion}"
...
}
}

It looks like logstash doesn't take sns region field as variable. I am sure the value is there. How should I wrote it?
Thanks!

[guyboertje]

You will need to use a if conditional block in your output section. The region setting is applied when LS boots up not per event.

Adjust as necessary.

output {
  if [SNSregion] == "us-east-1" {
    sns {
      region => "us-east-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-east-2" {
    sns {
      region => "us-east-2" arn => "xxxx"
    }
  } else if [SNSregion] == "us-west-1" {
    sns {
      region => "us-west-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-west-2" {
    sns {
      region => "us-west-2" arn => "xxxx"
    }
  } else if [SNSregion] == "eu-central-1" {
    sns {
      region => "eu-central-1" arn => "xxxx"
    }
  } else if [SNSregion] == "eu-west-2" {
    sns {
      region => "eu-west-2" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-southeast-1" {
    sns {
      region => "ap-southeast-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-southeast-2" {
    sns {
      region => "ap-southeast-2" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-northeast-1" {
    sns {
      region => "ap-northeast-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-northeast-2" {
    sns {
      region => "ap-northeast-2" arn => "xxxx"
    }
  } else if [SNSregion] == "sa-east-1" {
    sns {
      region => "sa-east-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-gov-west-1" {
    sns {
      region => "us-gov-west-1" arn => "xxxx"
    }
  } else if [SNSregion] == "cn-north-1" {
    sns {
      region => "cn-north-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-south-1" {
    sns {
      region => "ap-south-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ca-central-1" {
    sns {
      region => "ca-central-1" arn => "xxxx"
    }
  } else {
    # when all else fails, send to this region
    sns {
      region => "eu-west-1" arn => "xxxx"
    }
  }
}

[Akaren]

Thanks! But that really not nice way to do it

[guyboertje]

I know.