selin
(selin)
August 25, 2021, 5:10am
1
Below is my logstash configuration file
output {
if "%{[fields][myvalue1]}" == "value" and "%{[fields][myvalue2]}" == "valu" {
hosts => ["https://es1:9200","https://es2:9200","https://es3:9200"]
ilm_enabled => true
ilm_rollover_alias => "my_index"
ilm_pattern => "{now/d}-00001"
ilm_policy => "my_policy"
user => "username"
password => "mypassword"
}
}
I am hitting below error
Expected one of [ \\t\\r\\n], \"#\"
hunsw
(Attila)
August 25, 2021, 9:02am
2
Erm... it seems you are missing the type of output in your config.
E.g.
output {
elasticsearch {
hosts => "hostname"
.....
}
}
Also in the 2nd comparison, you have a typo (valu instead of value).
Cad
August 25, 2021, 9:06am
3
Hi,
The if need to be like this :
if [fields][myvalue1] == "value" and [fields][myvalue2] == "valu"
system
(system)
Closed
September 22, 2021, 9:07am
4
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.