Well, did you run that config? What was the output? I tend to use the json filter in this manner as I'm not sure if you can put an if condition inside of a filter.
input {
file {
path => "C:\xxx.log"
}
}
filter {
json {
source => "message"
}
if [approved] == 1 {
mutate {
add_field => {
"new_field" => "Application Accepted"
}
}
}
# this is optional if you don't want to collect events that are not approved
# else {
# drop {}
# }
}
output {
elasticsearch {
host => "localhost"
protocol => "http"
index => "xxx-%{+YYYY.MM.dd}"
}
}
You can use add_field in the json filter as well. However, you only want to add_field if [approved] == 1, so we have to breakout of the json filter to do that. You can use the json filter instead of mutate inside of the conditional clause if that bothers you. (add_field is pretty standard among the filters)
Can you run this in debug for one document and provide the output?
Also you didn't put the integer in double quotations originally, why changed? I'm wondering if it's treating them as string and not matching the equality.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.