How can I access an element in a list by index in Logstash?

I want to dynamically route my logs based on the strings in the tags of an event. I can't find any documentation for accessing an index of a list. Is this possible? If so, where can I find documentation on proper syntax?

input {}
filter {}
output {
    if "thisIsABackendApp" in [tags] {
          pipeline {
          ##    send_to => "${tags[1]}" ???
         }
    }
}

You can index into an array using "%{[tags][1]}", however, that requires that the reference be a place where a filter or output sprintf's the value of an option, and if I recall correctly, a pipeline output does not sprintf the name of the pipeline.

1 Like

Hey @Badger, thanks for the reply.

Unfortunately logstash gives me this:

[2019-09-12T12:10:05,221][WARN ][org.logstash.plugins.pipeline.PipelineBus] Attempted to send event to '%{[tags][1]}' but that address was unavailable. Maybe the destination pipeline is down or stopping? Will Retry.

Same goes if i try "$[tags][1]".

I might change my strategy and add fields using processors in filebeat.

Thanks for your help anyway!

I found documentation for syntax here under Field References:

https://www.elastic.co/guide/en/logstash/5.3/event-dependent-configuration.html

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.