If and problem

Elastic Stack Logstash
1

I have an erreur if use this condition in logstsh

        if [job] == "MNNATY0P02" and [statut] == "OK" {
        mutate {
        add_field  => { "statut_globale" => "1" }
         }
        }
2

what's the error exactly?

3

i use this condition but the colonne statut_globale not created in elastic

if [job] == "MNNATY0P02" and [job] == "MNNATY0P00" and [job]== "MNNATY0P00" and [job]== 
 "MNNATY0P99" and [job]== "MNNATY0P14" and [job]== "MNNATY0P13" and [job]== 
 "MNNATY0P12" and [job]== "MNNATY0P11" and [job]== "MNNATY0P10" and [job]== 
 " MNNATY0P09" and [job]== "MNNATY0P08" and [job]== "MNNATY0P07" and [job]== 
 "MNNATY0P06" and [job]== "MNNATY0P05" and [job]== "MNNATY0P03" and [job]== 
  "MNNATY0P01" and [statut] == "OK" {
 mutate {
 add_field  => { "statut_globale" => "1" }
}

}

4

Is the no error in the logstash logfile? besides the fieldname statut - which could be a typo - I don't see any error with it..

5

That is always going to evaluate to false. If the first test is true, the second is false, and the "and" of them will always be false.

1 Like
6

what is the error in this condition ?

if [job] == "MNNATY0P02" and [job] == "MNNATY0P00" and [job]== "MNNATY0P00" and [job]== 
 "MNNATY0P99" and [job]== "MNNATY0P14" and [job]== "MNNATY0P13" and [job]== 
 "MNNATY0P12" and [job]== "MNNATY0P11" and [job]== "MNNATY0P10" and [job]== 
 "MNNATY0P09" and [job]== "MNNATY0P08" and [job]== "MNNATY0P07" and [job]== 
 "MNNATY0P06" and [job]== "MNNATY0P05" and [job]== "MNNATY0P03" and [job]== 
 "MNNATY0P01" and [statut] == "OK" {
  mutate {
  add_field  => { "statut_globale" => "1" }
 }
7

As @Badger suggested, the condition you've shared will be ALWAYS false.

The job cannot be at the same time be equal to MNNATY0P02 AND MNNATY0P00 AND MNNATY0P13...

Alternatives:

if ([job] == "MNNATY0P02" or [job] == "MNNATY0P00" or [job]== "MNNATY0P00" or [job]== 
 "MNNATY0P99" or [job]== "MNNATY0P14" or [job]== "MNNATY0P13" or [job]== 
 "MNNATY0P12" or [job]== "MNNATY0P11" or [job]== "MNNATY0P10" or [job]== 
 "MNNATY0P09" or [job]== "MNNATY0P08" or [job]== "MNNATY0P07" or [job]== 
 "MNNATY0P06" or [job]== "MNNATY0P05" or [job]== "MNNATY0P03" or [job]== 
 "MNNATY0P01") and [statut] == "OK" {
  mutate {
  add_field  => { "statut_globale" => "1" }
 }

Alternatives:

if [statut] == "OK" and [job] =~ /^MNNATY0P(00|01|02|03|05|06|07|08|09|10|11|12|13|14|99)$/ {
  mutate {
    add_field  => { "statut_globale" => "1" }
  }
}
8

Thank Luca i have this error your Alternative

Sending Logstash logs to C:/Users/h83710/Desktop/elastic/logstash-7.5.2/logs which is now configured via log4j2.properties
[2020-04-29T14:18:44,383][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-04-29T14:18:44,599][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.5.2"}
[2020-04-29T14:18:47,916][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "=>" at line 14, column 4 (byte 283) after filter {\n csv {\n separator => ";"\n\t\tcolumns => [ "chaine", "job", "date_plan", "statut", "date_debut", "date_fin", "serveur", "numero_passage", "application", "sous_application" ]\n\n\nif ", :backtrace=>["C:/Users/h83710/Desktop/elastic/logstash-7.5.2/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "C:/Users/h83710/Desktop/elastic/logstash-7.5.2/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'", "C:/Users/h83710/Desktop/elastic/logstash-7.5.2/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2584:in map'", "C:/Users/h83710/Desktop/elastic/logstash-7.5.2/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:156:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "C:/Users/h83710/Desktop/elastic/logstash-7.5.2/logstash-core/lib/logstash/java_pipeline.rb:27:in initialize'", "C:/Users/h83710/Desktop/elastic/logstash-7.5.2/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "C:/Users/h83710/Desktop/elastic/logstash-7.5.2/logstash-core/lib/logstash/agent.rb:326:in block in converge_state'"]}

9

The errors says:

Expected one of [ \t\r\n], "#", "=>" at line 14, column 4 (byte 283) after filter {\n csv {\n separator => ";"\n\t\tcolumns => [ "chaine", "job", "date_plan", "statut", "date_debut", "date_fin", "serveur", "numero_passage", "application", "sous_application" ]\n\n\nif

From the error, it seems you didn't close the brackets in the csv filter.

10

Thank but it is possible two have all conditions met and add_field => { "statut_globale" => "1" }

11

Hello @Youssef_SBAI

The error is no more related to the if condition.
It is a syntax error because you didn't close the csv filter.

Post the full pipeline file if necessary.

If you feel more comfortable to write in French, please post the question in the section discussions en Francais.

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.