IF/THEN in output config not working properly

(Phil Williams) #1

I have created an output config for Logstash and attempted to specify which index for a few different feeds to go by using if then else statements in the config file. Reagardless of what I try, Data I do not want in the first filter ends up in that index and the one I specified for it. Data that is supposed to be cause by the first IF statement is nowhere to be found.

I am trying to isolate each data source in its own index without much luck. See the config below:


if [type] == "tomato"
hosts => ""
index => "tomato-%{+YYYY.MM.dd}"

else if "" in [host]
hosts => ""
index => "pfsense-%{+YYYY.MM.dd}"

hosts => ""
index => "logstash-%{+YYYY.MM.dd}"

codec => rubydebug


(Magnus Bäck) #2

Please give an example of an event that ended up in the wrong place. Copy the raw JSON event from Kibana's JSON tab.

(Phil Williams) #3

See below. The expected outcome was for this to end up in the pfsense -"date" index...which it did. However, it is also in the tomato index.

"_index": "tomato-2018.01.29",
"_type": "doc",
"_id": "s9LCP2EBkOR6wJ8oDxnP",
"_version": 1,
"_score": null,
"_source": {
"dest_ip": "",
"action": "pass",
"proto": "udp",
"tags": [
"@version": "1",
"src_port": "19318",
"dest_port": "25903",
"src_ip": "",
"geoip": {
"timezone": "America/Chicago",
"country_name": "United States",
"region_code": "AL",
"longitude": -86.5863,
"location": {
"lon": -86.5863,
"lat": 32.5141
"city_name": "Prattville",
"postal_code": "36067",
"dma_code": 698,
"country_code2": "US",
"ip": "",
"continent_code": "NA",
"country_code3": "US",
"region_name": "Alabama",
"latitude": 32.5141
"reason": "match",
"ip_ver": "4",
"tracker": "1000003811",
"offset": "0",
"direction": "out",
"rule": "40",
"flags": "DF",
"message": "40,,,1000003811,em0,match,pass,out,4,0x0,,3,18442,0,DF,17,udp,28,,,19318,25903,8",
"evtid": "134",
"length": "28",
"ttl": "3",
"prog": "filterlog",
"iface": "em0",
"id": "18442",
"@timestamp": "2018-01-29T02:32:18.000Z",
"data_length": "8",
"host": "",
"type": "syslog",
"tos": "0x0",
"proto_id": "17"
"fields": {
"@timestamp": [
"sort": [

(Magnus Bäck) #4

Do you have additional configuration files in /etc/logstash/conf.d (or wherever you keep them)? Do any of those files contain an elasticsearch output pointing to the tomato index?

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.