Hi All,
I am using elk version 7.2
I have two keywords
1- result
2 - service
using the values of these keywords i want to create another field which will met the condition and keep the data according to the condition in the new field.
My logstash condition for this is
if [result] == "Accepted" and "Rejected" and [service] == "merged"
{
mutate {
add_field => [ "result1" ]
}
}
but i am getting this errors while starting the logstash after writing this condition.
[2020-06-22T14:27:19,361][ERROR][logstash.filters.mutate ] Invalid setting for mutate filter plugin:
filter {
mutate {
# This setting must be a hash
# This field must contain an even number of items, got 1
add_field => ["result1"]
...
}
}
Can anyone please help me out to resolve these issues
Thanks in advance