# How to use if else statments in logstash output pipline?

**URL:** <https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199>\
**Category:** Logstash\
**Created:** [February 9, 2018, 9:32am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199 "2018-02-09T09:32:54Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robin\_Guo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robin_guo/32/42297_2.png) [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\
**Post date:** [February 9, 2018, 9:32am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/1 "2018-02-09T09:32:54Z")

</div>

Dear ES folks,

Here is my request, I want to split the index by tags and environment.

Can someone help me out?

**The logical like this：**

"system" in [tags] =\> index =\> "system-%{+YYYY.MM}"  
"nginx" in [tags] =\> index =\> "nginx-%{+YYYY.MM}"  
not ("nginx" and "system") in [tags] and [env]="production" =\>other-production-%{+YYYY}  
not ("nginx" and "system") in [tags] and [env]="test" =\>other-test-%{+YYYY}

code:

```auto
#logstash for tlsbeat
input {
 tcp {
   port => 5045
 }
}

filter {

 if "_jsonparsefailure" in [tags] {
       drop { }
 }
 
 json {
   source => "message"
 }
 
 mutate {
   remove_field => ["message"]
   add_field => { "[@metadata][index_prefix]" => "%{agent}-%{env}-%{service}" }  
   remove_field => ["agent","env","host","port","service"]
 }
 
}

output {
 
 if "system" in [tags] {  
   elasticsearch {
     hosts => ["elkdbtest01.tls.ad"]
     template_overwrite => false
     manage_template => false
     index => "%{[@metadata][index_prefix]}-%{+YYYY.MM}"
     sniffing => false

   }      
 } 
 
 else if "nginx" in [tags] {  
   elasticsearch {
     hosts => ["elkdbtest01.tls.ad"]
     template_overwrite => false
     manage_template => false
     index => "%{[@metadata][index_prefix]}-%{+YYYY}"
     sniffing => false
   }      
 }

}

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 9, 2018, 10:15am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/2 "2018-02-09T10:15:26Z")

</div>

Why not set the `[@metadata][index_prefix]` field to the correct index prefix in the filter block and then use a single Elasticsearch output as all parameters except the index name appear to be the same?

---

<div class="post-metadata">

**Author:** ![Robin\_Guo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robin_guo/32/42297_2.png) [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\
**Post date:** [February 9, 2018, 10:27am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/3 "2018-02-09T10:27:05Z")

</div>

> [@Robin\_Guo](#):
>
> if "system" in [tags] {  
> elasticsearch {  
> hosts =\> ["elkdbtest01.tls.ad"]  
> template\_overwrite =\> false  
> manage\_template =\> false  
> index =\> "%{[@metadata][index\_prefix]}-%{+YYYY.MM}"  
> sniffing =\> false
> 
> }  
> }

Hey @Christian_Dahlqvist,

I used [@metadata][index\_prefix] for following tags  
"system" in [tags] =\> index =\> "system-%{+YYYY.MM}"  
"nginx" in [tags] =\> index =\> "nginx-%{+YYYY.MM}"  
not nginx and system =\> =\> index =\> "other -%{+YYYY.MM}"

I can't use single one elasticsearch output. It's hard to say, It's a little more complicated than normal one.  
if I use one ES output, It will generate a dozen of indices, I just want to generate 3 kinds of type index,

System, Nginx And others put them as a single one.

can you suggest or give me an example?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 9, 2018, 10:33am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/4 "2018-02-09T10:33:17Z")

</div>

What Christian means is, set `[@metadata][index_prefix]` to the index prefix you want and use a single elasticsearch output with

```
index => "%{[@metadata][index_prefix]}-%{+YYYY}"

```

in the configuration. Perhaps this would work:

```nohighlight
if "system" not in [tags] and "nginx" not in [tags] {
  mutate {
    replace => {
      "[@metadata][index_prefix]" => "other-%{env}"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Robin\_Guo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robin_guo/32/42297_2.png) [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\
**Post date:** [February 9, 2018, 10:46am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/5 "2018-02-09T10:46:00Z")

</div>

Hi @magnusbaeck,

It doesn't work well.

It gets the index name like this:

```auto
"%{agent}-%{env}-2018.02"

```

---

<div class="post-metadata">

**Author:** ![Robin\_Guo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robin_guo/32/42297_2.png) [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\
**Post date:** [February 9, 2018, 10:49am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/6 "2018-02-09T10:49:00Z")

</div>

Here is my complete logstash pipline configuration ：

both system and nginx tags are working well for generating the index what I want .  
for neither system nor nginx tags, the variables can't be substituted. %{agent}-%{env}-2018.02

```auto

#logstash for tlsbeat
input {
  tcp {
    port => 5045
  }
}

filter {

  if "_jsonparsefailure" in [tags] {
        drop { }
  }
  
  json {
    source => "message"
  }
  
  mutate {
    remove_field => ["message"]
    add_field => { "[@metadata][index_prefix]" => "%{agent}-%{env}-%{service}" }  
    remove_field => ["agent","env","host","port","service"]
  }
  
}

output {
  
  if "system" in [tags] {  
    elasticsearch {
      hosts => ["esdatatest01.tls.ad:9200","esdatatest02.tls.ad:9200","esdatatest03.tls.ad:9200","esdatatest04.tls.ad:9200","esdatatest05.tls.ad:9200","esdatatest06.tls.ad:9200","esdatatest07.tls.ad:9200",
               "esdatatest08.tls.ad:9200","esdatatest09.tls.ad:9200","esdatatest10.tls.ad:9200","esdatatest11.tls.ad:9200","esdatatest12.tls.ad:9200","esdatatest13.tls.ad:9200","esdatatest14.tls.ad:9200",
               "esdatatest15.tls.ad:9200","esdatatest16.tls.ad:9200","esdatatest17.tls.ad:9200","esdatatest18.tls.ad:9200","esdatatest19.tls.ad:9200","esdatatest20.tls.ad:9200"]
      template_overwrite => false
      manage_template => false
      index => "%{[@metadata][index_prefix]}-%{+YYYY.MM}"
      sniffing => false

    }      
  } 
  
  if "nginx" in [tags] {  
    elasticsearch {
      hosts => ["esdatatest01.tls.ad:9200","esdatatest02.tls.ad:9200","esdatatest03.tls.ad:9200","esdatatest04.tls.ad:9200","esdatatest05.tls.ad:9200","esdatatest06.tls.ad:9200","esdatatest07.tls.ad:9200",
               "esdatatest08.tls.ad:9200","esdatatest09.tls.ad:9200","esdatatest10.tls.ad:9200","esdatatest11.tls.ad:9200","esdatatest12.tls.ad:9200","esdatatest13.tls.ad:9200","esdatatest14.tls.ad:9200",
               "esdatatest15.tls.ad:9200","esdatatest16.tls.ad:9200","esdatatest17.tls.ad:9200","esdatatest18.tls.ad:9200","esdatatest19.tls.ad:9200","esdatatest20.tls.ad:9200"]
      template_overwrite => false
      manage_template => false
      index => "%{[@metadata][index_prefix]}-%{+YYYY}"
      sniffing => false
    }      
  }
  
  if "system" not in [tags] and "nginx" not in [tags] {
    elasticsearch {
      hosts => ["esdatatest01.tls.ad:9200","esdatatest02.tls.ad:9200","esdatatest03.tls.ad:9200","esdatatest04.tls.ad:9200","esdatatest05.tls.ad:9200","esdatatest06.tls.ad:9200","esdatatest07.tls.ad:9200",
               "esdatatest08.tls.ad:9200","esdatatest09.tls.ad:9200","esdatatest10.tls.ad:9200","esdatatest11.tls.ad:9200","esdatatest12.tls.ad:9200","esdatatest13.tls.ad:9200","esdatatest14.tls.ad:9200",
               "esdatatest15.tls.ad:9200","esdatatest16.tls.ad:9200","esdatatest17.tls.ad:9200","esdatatest18.tls.ad:9200","esdatatest19.tls.ad:9200","esdatatest20.tls.ad:9200"]
      template_overwrite => false
      manage_template => false
      index => "%{agent}-%{env}-%{+YYYY.MM}"
      sniffing => false
    }    
  } 
}

```

---

<div class="post-metadata">

**Author:** ![Robin\_Guo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robin_guo/32/42297_2.png) [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\
**Post date:** [February 9, 2018, 10:51am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/7 "2018-02-09T10:51:56Z")

</div>

please help me out,  
I need to get it done as soon as possible, cuz Chinese new year is coming soon.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 9, 2018, 11:02am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/8 "2018-02-09T11:02:27Z")

</div>

Something along these lines should work:

```auto
filter {
  if "system" in [tags] { 
    mutate {
      add_field => { "[@metadata][index_prefix]" => "%{agent}-%{env}-%{service}" }
    }
  } else if "nginx" in [tags] {
    mutate {
      add_field => { "[@metadata][index_prefix]" => "%{agent}-%{env}-%{service}" }
    }
  } else {
    mutate {
      add_field => { "[@metadata][index_prefix]" => "%{agent}-%{env}" }
    }
  }

  mutate {
    remove_field => ["agent","env","host","port","service","message"]
  }
}

output { 
  elasticsearch {
    hosts => ["esdatatest01.tls.ad:9200","esdatatest02.tls.ad:9200","esdatatest03.tls.ad:9200","esdatatest04.tls.ad:9200","esdatatest05.tls.ad:9200","esdatatest06.tls.ad:9200","esdatatest07.tls.ad:9200",
               "esdatatest08.tls.ad:9200","esdatatest09.tls.ad:9200","esdatatest10.tls.ad:9200","esdatatest11.tls.ad:9200","esdatatest12.tls.ad:9200","esdatatest13.tls.ad:9200","esdatatest14.tls.ad:9200",
               "esdatatest15.tls.ad:9200","esdatatest16.tls.ad:9200","esdatatest17.tls.ad:9200","esdatatest18.tls.ad:9200","esdatatest19.tls.ad:9200","esdatatest20.tls.ad:9200"]
    template_overwrite => false
    manage_template => false
    index => "%{[@metadata][index_prefix]}-%{+YYYY.MM}"
    sniffing => false
  }      
} 

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 9, 2018, 11:19am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/9 "2018-02-09T11:19:15Z")

</div>

> It gets the index name like this:
> 
> ```
> "%{agent}-%{env}-2018.02"
> 
> ```

Of course, because you're deleting those fields in your mutate filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2018, 11:19am UTC](https://discuss.elastic.co/t/how-to-use-if-else-statments-in-logstash-output-pipline/119199/10 "2018-03-09T11:19:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.