Is it possible to pass "nil" in a @metadata field to "pipeline =>" on elasticsearch output

Elastic Stack Logstash
1

Hello,

this might be a slightly odd question. I have been successfully gotten by with no conditionals in the output section of my Logstash config for quite some time now. I would however like to start to make use of Elasticsearch ingest pipelines which would mean I have to pass pipeline to Elasticsearch on the elasticsearch output.

My goal config would be

output {
  elasticsearch {
        hosts => ["10.0.0.1:9200"]
        index => "%{[@metadata][log_prefix]}-%{[@metadata][index]}-%{[@metadata][date]}"
        pipeline => "%{[@metadata][pipeline]}"
  }
}

According to this documentation this field is not required and the default value is nil.

When I try to set pipeline to nil or set [@metadata][pipeline] to nil, Logstash can not index any document. I might do something wrong...

I have created a "dummy" ingest pipeline in Elasticsearch and that seems to work. The pipeline adds one field, which I would like to avoid. I assume Elasticsearch ingest nodes have more work to do as well (of course adding that field).

Is this just the way it is? Now that I see my config here I see that %{[@metadata][pipeline]} is quoted so passing nil will not work...

Any suggestions or ideas? :slight_smile:

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.