Hi All,
I am a newbie to the elk.
I am currently using logstash version 7.2.
My issue here is to update and new values to the keywords,
Below is my logstash configuration file
input {
http {
host => "0.0.0.0"
port => xxxx
threads => 100
}
}
filter {
if [headers][request_method] == "GET" {
drop{}
} else {
json {
source => "message"
remove_field => [ "headers", "message", "host" ]
}
date {
match => [ "timeStamp", "ISO8601" ]
target => "timeStamp"
}
fingerprint {
source => [ "origin", "originLogId" ]
target => "[@metadata][fingerprint]"
method => "SHA256"
key => "@AUDITTRAIL-NOSQL@"
concatenate_sources => true
}
if [service] in ["F_N_C_R", "F_N_C_R_W_N"]
{
mutate {
update => { "service" => "F N C" }
}
if [result] in ["HIT"]
{
mutate {
update => { "result" => "Number of biometric HIT" }
}
}
if [result] in ["NO_HIT"]
{
mutate {
update => { "result" => "Number of biometric NO HIT" }
}
}
if [result] in ["REQUEST_ACCEPTED"]
{
mutate {
update => { "result" => "Identity Accepted" }
}
}
if [result] in ["REQUEST_REJECTED"]
{
mutate {
update => { "result" => "Identity Rejected" }
}
}
if [service] in ["IDENTITY_MERGE"]
{
mutate {
update => { "service" => "Identity merged" }
}
}
if [AT_VAL1] in ["APPROVED"]
{
mutate {
update => { "AT_VAL1" => "Number of approved requests" }
}
}
if [AT_VAL1] in ["NOT_APPROVED"]
{
mutate {
update => { "AT_VAL1" => "Number of rejected requests" }
}
}
if [AT_VAL1] in ["PERSONALISE"]
{
mutate {
update => { "AT_VAL1" => "Personalized cards" }
}
}
if [AT_VAL1] in ["DISPATCH"]
{
mutate {
update => { "AT_VAL1" => "Dispatched cards" }
}
}
if [AT_VAL1] in ["SECURED"]
{
mutate {
update => { "AT_VAL1" => "Issued cards" }
}
}
if [AT_VAL1] in ["REVOCATION"]
{
mutate {
update => { "AT_VAL1" => "Terminated cards" }
}
}
}
}
output {
elasticsearch {
hosts => [ "xx.xx.xx.xx:xxxx" ]
index => "test-%{+YYYY.MM.dd}"
document_id => "%{[@metadata][fingerprint]}"
}
}
So the issue is the first if statement works perfectly for my Elasticsearch data,
But my subsequent if statements aren't working
The logstash able to read the configuration with no errors but in kibana my data isn't coming as i expect.
Please help to fix this issue
although I don't have a direct use for it.