Filebeat apache module add_labels process and if conditions

Elastic Stack Beats
1

Hi,
I would like to add labels in filebeat apache module conf file with 3 conditions.
I use input processors and if/then/else statements in apache.yml. Like that it's works :

input:
  processors:
    - if:
        regexp:
          log.file.path: ".*foo.*"
      then:
        add_labels:
          labels:
            env: foo
      else:
        add_labels:
          labels:
            env: nobody

But when i introduce the 3rd condition like that, filebeat starts but no harvester are launched and no logs sent to elasticsearch :

input:
  processors:
    - if:
        regexp:
          log.file.path: ".*foo.*"
      then:
        add_labels:
          labels:
            env: foo
      else if:
        regexp:
          log.file.path: ".*bar.*"
      then:
        add_labels:
          labels: bar
      else:
        add_labels:
          labels:
            env: nobody

I have also tried like that (but still the same behaviour) :

input:
  processors:
    - if:
        regexp:
          log.file.path: ".*foo.*"
      then:
        add_labels:
          labels:
            env: foo
      elif:
        regexp:
          log.file.path: ".*bar.*"
      then:
        add_labels:
          labels: bar
      else:
        add_labels:
          labels:
            env: nobody

or :

input:
  processors:
    - if:
        regexp:
          log.file.path: ".*foo.*"
      then:
        add_labels:
          labels:
            env: foo
   - if:
        regexp:
          log.file.path: ".*bar.*"
      then:
        add_labels:
          labels: bar
      else:
        add_labels:
          labels:
            env: nobody

It seems filebeat supports only one if statement in the input processor context.
Or i simply do something wrong :frowning:

Thanks for your read ... and answer.
nico

2

Hi

With this syntax it's work :

input:
  processors:
    - if:
        regexp:
          log.file.path: ".*foo.*"
      then:
        add_labels:
          labels:
            env: foo
      else:
        if:
          regexp:
            log.file.path: ".*bar.*"
        then:
          add_labels:
            labels:
              env: bar
        else:
          add_labels:
            labels: nobody

nico

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.