filter {
if ["location_lat"] == “34.802075” {
mutate {
add_field => { “Country” => “Syria” }
}
}
if ["location_lat"] == “44.016521” {
mutate {
add_field => { “Country” => “Serbia” }
}
}
if ["location_lat"] == “4.570868” {
mutate {
add_field => { “Country” => “Colombia” }
}
}
if ["location_lat"] == “9.30769” {
mutate {
add_field => { “Country” => “Benin” }
}
}
if ["location_lat"] == “41.153332” {
mutate {
add_field => { “Country” => “Albania” }
}
}
if ["location_lat"] == “14.497401” {
mutate {
add_field => { “Country” => “Senegal” }
}
}
if ["location_lat"] == “31.791702” {
mutate {
add_field => { “Country” => “Morocco” }
}
}
if ["location_lat"] == “48.379433” {
mutate {
add_field => { “Country” => “Ukraine” }
}
}
if ["location_lat"] == “17.570692” {
mutate {
add_field => { “Country” => “Mali” }
}
}
if ["location_lat"] == “42.315407” {
mutate {
add_field => { “Country” => “Georgia” }
}
}
if ["location_lat"] == “-19.015438” {
mutate {
add_field => { “Country” => “Zimbabwe” }
}
}
if ["location_lat"] == “9.145” {
mutate {
add_field => { “Country” => “Ethiopia” }
}
}
if ["location_lat"] == “1.373333” {
mutate {
add_field => { “Country” => “Uganda” }
}
}
if ["location_lat"] == “-6.369028” {
mutate {
add_field => { “Country” => “Tanzania” }
}
}
if ["location_lat"] == “-1.831239” {
mutate {
add_field => { “Country” => “Ecuador” }
}
}
if ["location_lat"] == “-0.023559” {
mutate {
add_field => { “Country” => “Kenya” }
}
}
if ["location_lat"] == “-23.442503” {
mutate {
add_field => { “Country” => “Paraguay” }
}
}
mutate {
copy => { "_id" => "[@metadata][_id]"}
}
mutate{
remove_field => ["_id"]
}
mutate{
remove_field => ["image_url"]
}
mutate{
remove_field => ["maintext"]
}
mutate {
convert => { "civic1_event_type" => "string" }
}
mutate {
convert => { "RAI_event_type" => "string" }
}
mutate {
copy => {
"location_lon" => "[location][lon]"
"location_lat" => "[location][lat]"
}
}
}
This is my Logstash Filter and it was working before. I just added the if statements to add a new field within the data but I am getting this error. I tried to format them at the end as well but I wasn't able to get it to work. I do still want to ensure that the rest of the mutations are applied to all of the documents.
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", '\"', \"'\", \"-\", [0-9], \"[\", [A-Za-z_], '/' at line 13, column 24 (byte 392) after filter {\n\n\nif [\"location_lat\"] == ", :backtrace=>["/Users/caitlyncarlisle/Desktop/logstash-7.12.0/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/Users/caitlyncarlisle/Desktop/logstash-7.12.0/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/Users/caitlyncarlisle/Desktop/logstash-7.12.0/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/Users/caitlyncarlisle/Desktop/logstash-7.12.0/logstash-core/lib/logstash/agent.rb:389:in `block in converge_state'"]}