If [@metadata][field] {} doesnot work

Elastic Stack Logstash
1

I'm trying to give syntax like 'if [@metadata][field] exists then do this' in output
output{
if [@metadata][field] {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "%{[@metadata][field]}"
}
}
}
I used two config files. One config file , I created input{} filter{} output{}(like above) , other file only filter{} which adds a field [@metadata][field] like
filter{
mutate {
add_field => { "[@metadata][index_name]" => "abc" }
}
}

The index gets created in elasticsearch, when I comment the if statement in the output, but when I remove, it does not get created.
How to make command enter into if statement?

2

Please show the exact configuration you're using so that we can try to reproduce the issue. Which Logstash version?

4

I suggest you add a stdout { codec => rubydebug { metadata => true } } output to see what metadata fields you really have.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.