If condition in Logstash

Elastic Stack Logstash
1

Hi,
I've the logs coming from different sources and I have running thru the ruby code to parse them.
I need to create an IF condition, so that based on the Job name it has to move to the other ruby loops.
The Job name comes as something like this in JSON:

 "data": {
       "JOB_NAME": "ATC/SNX/System1"

I wrote a if condition as below:

filter {
  if [data][JOB_NAME] in "ATC" { 
  ruby  {
  code => "
  puts '***'
  "
 }
}

But the problem here, if the Job name which doesn't contain 'ATC' is also going thru the ruby code. Could you please help me out. Thanks !

2

I think you want...

if "ATC" in [data][JOB_NAME]
3

Hi,
you can do like this:

if [data][JOB_NAME] in ['ATC']

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.