If [type] is not working in logstash 2.3.2

Elastic Stack Logstash
1

input {
jdbc {
type => "deploymaster"
jdbc_driver_library => ""
jdbc_driver_class => ""
jdbc_connection_string => ""
jdbc_user => ""
jdbc_password => ""
statement => ""
}
}
output {
if [type] == "deploymaster"{
elasticsearch { hosts => ["localhost:9200"]
index => "metricslog"
}
}
}

The type option is also not working. I am not able to see the output in elastic search

Note:
Although i solved the problem of using multiple inputs and outputs in single logstash conf file by taking advantage of "tags" i want to know why "type" option is not working in logstash_2.3.2

2

This should work. What if you remove some complexity and replace the elasticsearch output with a simple stdout { codec => rubydebug } output? And maybe replace the jdbc input with a stdin input? Divide and conquer!

3

Thank you for your reply. If i remove the "type" check in the output everything works fine. So i do not think having JDBC or Elastic Search is a problem here. Let me know if I am right.

4

I don't do hypothetical questions. I can only help if you answer my questions.

5

The same sh*t for me! Spend several hours, dumped the port traffic to find out the reason. The config is:
input {
beats {
port => 5047
codec => "json"
type => "my-debug"
}
}
output {
if [type] == "my-debug" {
stdout { codec => rubydebug }
}
}
If I remove "if" all works fine. Logstash is 2.2.2

6

Suddenly:
The Beats shipper automatically sets the type field on the event. You cannot override this setting in the Logstash config. If you specify a setting for the type config option in Logstash, it is ignored.
https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-type

This worked for me:
input {
beats {
port => 5047
codec => "json"
tags => ["my-debug"]
}
}
output {
if "my-debug" in [tags] {
stdout { codec => rubydebug }
}
}

Simplest task. Simplest condition. I just want to say: #@%&* developers!!!

1 Like