# Event field in logstash output

**URL:** <https://discuss.elastic.co/t/event-field-in-logstash-output/115717>\
**Category:** Logstash\
**Created:** [January 16, 2018, 1:04pm UTC](https://discuss.elastic.co/t/event-field-in-logstash-output/115717 "2018-01-16T13:04:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akaren](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@Akaren](https://discuss.elastic.co/u/Akaren)\
**Post date:** [January 16, 2018, 1:04pm UTC](https://discuss.elastic.co/t/event-field-in-logstash-output/115717/1 "2018-01-16T13:04:34Z")

</div>

Hi, in my logstash config in output part I have sns settings:

`sns { region => "eu-west-1" arn => "xxxx" }`

It works but every event has inside field called "SNSregion" that contains region (we get it from user gui...). So I need to put this field into sns settings. But both of ways doesn't work...

`sns { region => [SNSregion] arn => "xxxx" }`

`sns { region => "%{SNSregion}" arn => "xxxx" }`

It shows error:

[2018-01-16T10:13:08,497][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Something is wrong with your configuration."}  
[2018-01-16T10:13:34,202][ERROR][logstash.outputs.sns] Invalid setting for sns output plugin:

output {  
sns {  
# This setting must be a ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "eu-central-1", "eu-west-1", "eu-west-2", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ap-northeast-2", "sa-east-1", "us-gov-west-1", "cn-north-1", "ap-south-1", "ca-central-1"]  
# Expected one of ["us-east-1", "us-east-2", "us-west-1", "us-west-2", "eu-central-1", "eu-west-1", "eu-west-2", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ap-northeast-2", "sa-east-1", "us-gov-west-1", "cn-north-1", "ap-south-1", "ca-central-1"], got ["%{SNSregion}"]  
region =\> "%{SNSregion}"  
...  
}  
}

It looks like logstash doesn't take sns region field as variable. I am sure the value is there. How should I wrote it?  
Thanks!

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 16, 2018, 3:01pm UTC](https://discuss.elastic.co/t/event-field-in-logstash-output/115717/2 "2018-01-16T15:01:01Z")

</div>

You will need to use a if conditional block in your output section. The region setting is applied when LS boots up not per event.

Adjust as necessary.

```auto
output {
  if [SNSregion] == "us-east-1" {
    sns {
      region => "us-east-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-east-2" {
    sns {
      region => "us-east-2" arn => "xxxx"
    }
  } else if [SNSregion] == "us-west-1" {
    sns {
      region => "us-west-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-west-2" {
    sns {
      region => "us-west-2" arn => "xxxx"
    }
  } else if [SNSregion] == "eu-central-1" {
    sns {
      region => "eu-central-1" arn => "xxxx"
    }
  } else if [SNSregion] == "eu-west-2" {
    sns {
      region => "eu-west-2" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-southeast-1" {
    sns {
      region => "ap-southeast-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-southeast-2" {
    sns {
      region => "ap-southeast-2" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-northeast-1" {
    sns {
      region => "ap-northeast-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-northeast-2" {
    sns {
      region => "ap-northeast-2" arn => "xxxx"
    }
  } else if [SNSregion] == "sa-east-1" {
    sns {
      region => "sa-east-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-gov-west-1" {
    sns {
      region => "us-gov-west-1" arn => "xxxx"
    }
  } else if [SNSregion] == "cn-north-1" {
    sns {
      region => "cn-north-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-south-1" {
    sns {
      region => "ap-south-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ca-central-1" {
    sns {
      region => "ca-central-1" arn => "xxxx"
    }
  } else {
    # when all else fails, send to this region
    sns {
      region => "eu-west-1" arn => "xxxx"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Akaren](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@Akaren](https://discuss.elastic.co/u/Akaren)\
**Post date:** [January 16, 2018, 6:14pm UTC](https://discuss.elastic.co/t/event-field-in-logstash-output/115717/3 "2018-01-16T18:14:21Z")

</div>

Thanks! But that really not nice way to do it 😃

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 16, 2018, 6:39pm UTC](https://discuss.elastic.co/t/event-field-in-logstash-output/115717/4 "2018-01-16T18:39:37Z")

</div>

I know. 😞

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2018, 6:39pm UTC](https://discuss.elastic.co/t/event-field-in-logstash-output/115717/5 "2018-02-13T18:39:42Z")

</div>

Closed on February 13, 2018, 6:39pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.