Grok, If condition in elasticsearch section

Hello guys!

I'm trying to use if condition in the elasticsearch section.
I want to write to different indexes depending on ip. what's wrong? :worried:

if [node_ip] == "" or ""
index => "node1-%{+YYYY.MM.dd}"
hosts = > ["elasticsearchhost:9200"]
else if [node_ip] == "" or ""
index => "node2-%{+YYYY.MM.dd}"
hosts = > ["elasticsearchhost:9200"]

You can not use conditionals within a plugin. Instead create multiple elasticsearch plugins with the correct config within conditionals.

Another option is to set a field that holds the prefix based on the conditionals and then use this in the index name specification within a single Elasticsearch output plugin.

1 Like

Question moved to #logstash

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.