If condition regex error

Elastic Stack Logstash
1

Hi,

I created a working logstash.conf with if/else conditions. Now I'm trying to implement regex to make the filters less messy. The current filter is like this:

filter {
        if [tag] == /^[a|b|c]*$/ {
        mutate { add_field => { "[@metadata][target_index]" => "%{tag}-%{+YYYY.MM.dd}" } }
      } else if [tag] == /^[d|e|f]*$/ {
        mutate { add_field => { "[@metadata][target_index]" => "%{tag}-%{+YYYY.MM}" } }
      } else if [tag] == /^[abc|def]*$/ {
        mutate { add_field => { "[@metadata][target_index]" => "%{tag}-%{+xxxx.ww}" } }
      } else {
        mutate { add_field => { "[@metadata][target_index]" => "%{tag}-%{+YYYY}" } }
      }
    }

But got this error while creating logstash container:

[2021-01-13T06:26:04,851][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::IllegalArgumentException", :message=>"Failed to parse right-hand side of conditional [file]/usr/share/logstash/pipeline/logstash.conf:8:12:```\n[tag] == /^[a|b|c]*$/\n```", :backtrace=>["org.logstash.config.ir.expression.BinaryBooleanExpression.ensureNotNull(org/logstash/config/ir/expression/BinaryBooleanExpression.java:74)", "org.logstash.config.ir.expression.BinaryBooleanExpression.<init>(org/logstash/config/ir/expression/BinaryBooleanExpression.java:54)", "org.logstash.config.ir.expression.binary.Eq.<init>(org/logstash/config/ir/expression/binary/Eq.java:29)", "org.logstash.config.ir.DSL.eEq(org/logstash/config/ir/DSL.java:133)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke(jdk/internal/reflect/NativeMethodAccessorImpl.java:62)", "jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:426)", "org.jruby.javasupport.JavaMethod.invokeStaticDirect(org/jruby/javasupport/JavaMethod.java:358)", "org.jruby.RubyMethod.call(org/jruby/RubyMethod.java:131)", "org.jruby.RubyMethod$INVOKER$i$call.call(org/jruby/RubyMethod$INVOKER$i$call.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:457)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:432)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.join_conditions(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:379)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.join_conditions(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:378)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$join_conditions$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:327)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr_cond(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:296)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr_cond$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:242)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:239)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "org.jruby.RubySymbol$SymbolProcBody.yieldInner(org/jruby/RubySymbol.java:1440)", "org.jruby.RubySymbol$SymbolProcBody.doYield(org/jruby/RubySymbol.java:1456)", "org.jruby.RubyArray.collect(org/jruby/RubyArray.java:2563)", "org.jruby.RubyArray.map(org/jruby/RubyArray.java:2577)", "org.jruby.RubyArray$INVOKER$i$0$0$map19.call(org/jruby/RubyArray$INVOKER$i$0$0$map19.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:85)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.compile(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:64)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.compile(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:62)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.compile_imperative(/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:62)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.RUBY$method$compile_imperative$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/compiler.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.compile_graph(/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:66)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.RUBY$method$compile_graph$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/compiler.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.compile_sources(/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:28)", "org.jruby.RubyArray.collect(org/jruby/RubyArray.java:2563)", "org.jruby.RubyArray.map(org/jruby/RubyArray.java:2577)", "org.jruby.RubyArray$INVOKER$i$0$0$map19.call(org/jruby/RubyArray$INVOKER$i$0$0$map19.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.compile_sources(/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:27)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.RUBY$method$compile_sources$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/compiler.rb)", "org.jruby.RubyClass.finvoke(org/jruby/RubyClass.java:812)", "org.jruby.RubyBasicObject.callMethod(org/jruby/RubyBasicObject.java:372)", "org.logstash.config.ir.ConfigCompiler.configToPipelineIR(org/logstash/config/ir/ConfigCompiler.java:53)", "org.logstash.execution.AbstractPipelineExt.initialize(org/logstash/execution/AbstractPipelineExt.java:181)", "org.logstash.execution.JavaBasePipelineExt.initialize(org/logstash/execution/JavaBasePipelineExt.java:67)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(org/logstash/execution/JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.initialize(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43)", "org.jruby.RubyClass.newInstance(org/jruby/RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(org/jruby/RubyClass$INVOKER$i$newInstance.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.execute(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$__VARARGS__(usr/share/logstash/logstash_minus_core/lib/logstash/pipeline_action//usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.converge_state(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:318)", "java.lang.Thread.run(java/lang/Thread.java:834)"]}

What am i missing?
Thanks.

2

Ok i found the problem. I used "==" between key and value it should be "=~" now it works.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.