How to set a condition in set processor (ingest node pipeline) to check if log.level= error

Elastic Stack Elasticsearch
1

Hi, my doc looks like this and I need to access log.level which is a nested field. can someone help me as I need a condition to set a new field called statuscode if log.level=error.

image

tried ctx.messageinfo.log.level=="error" and ctx?.messageinfo?.log.level=="error"
both did not work

2

Think you are looking for this.

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "set": {
          "field": "field-name",
          "value": "value",
          "if": "ctx.messageinfo['log.level'] == 'error'"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "messageinfo": {
          "log.level": "error"
        }
      }
    }
  ]
}
4

Thanks a ton Aaron . This works as expected. Much appreciated!