Filtre logstash "if not"


(Salma Ait Lhaj) #1

Hi,

Can someone help me please :

When test my configuration, I have this error :

[2018-07-19T15:01:56,149][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

in this part of the file !!

    if !([Application] == "smtp" or [Application] == "smtps") {
      drop { }
    }

#2

Try

if "smtp" not in [Application] or "smtps" not in [Application] {
drop { }
}


(Salma Ait Lhaj) #3

No, the problem begin in : if " ....

  else if [fields][log_type] == "paloalto_smtp" {
    csv{
      source => "data"
      columns => ["FUTURE_USE","Receive Time","Serial Number","Type","Threat/Content Type", "FUTURE_USE","Generated Time","src_ip","dst_ip","NAT Source IP", "NAT Destination IP$
    }
    if "
[2018-07-19T15:35:27,686][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

(Magnus B├Ąck) #5

The log message you quoted is just the final "something went bad, shutting down" message. The interesting log message comes before that. Seeing the complete configuration would also be helpful.


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.