I want to dynamically route my logs based on the strings in the tags of an event. I can't find any documentation for accessing an index of a list. Is this possible? If so, where can I find documentation on proper syntax?
You can index into an array using "%{[tags][1]}", however, that requires that the reference be a place where a filter or output sprintf's the value of an option, and if I recall correctly, a pipeline output does not sprintf the name of the pipeline.
[2019-09-12T12:10:05,221][WARN ][org.logstash.plugins.pipeline.PipelineBus] Attempted to send event to '%{[tags][1]}' but that address was unavailable. Maybe the destination pipeline is down or stopping? Will Retry.
Same goes if i try "$[tags][1]".
I might change my strategy and add fields using processors in filebeat.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.