Issue with conditional in output definition

Elastic Stack Logstash
1

trying to put two conditions on my output for grok or geopip failure
I tried :
if ("_grokparsefailure" not in [tags] or "_geoip_lookup_failure" not in [tags])
if "_grokparsefailure" not in [tags] or "_geoip_lookup_failure" not in [tags]
if "_grokparsefailure" or "_geoip_lookup_failure" not in [tags]
if ("_grokparsefailure" or "_geoip_lookup_failure" not in [tags])
if "_grokparsefailure" not in [tags] {
...
}
else if "_geoip_lookup_failure" not in [tags] [
..
}

stiil get "Invalid index name [xxx,_geoip_lookup_failure-2019.01.31]

Can you help me please

2

You cannot have a comma in an index name.

You can see what is not allowed by looking at the tests (also here).

3

I know that s not the point I talk about conditional , works with if "_grokparsefailure" not in [tags] {
trying with two conditions!

4

OK, so that evaluates to false on events that have both tags, otherwise true. Is that what you want? If not, what do you want?

5

so that evaluates to false on events that have both tags --> not both tags at least one of them

6

If a document has _grokparsefailure but not _geoip_lookup_failure then that evaluates to (false or true), which evaluates to true.

Perhaps you want

if ("_grokparsefailure" in [tags] or "_geoip_lookup_failure" in [tags]) {
    # One or both
} else {
    # Neither
}
7

I want if ("_grokparsefailure" not in [tags] or "_geoip_lookup_failure" not in [tags]) --> don t work !! stiil get "Invalid index name [xxx,_geoip_lookup_failure-2019.01.31]
"or" in the condition seems not working with "(" or not

8

Ok the problem is logstash can't have two "not in" conditions
if ("_grokparsefailure" not in [tags] or "_geoip_lookup_failure" not in [tags])--> don t work

if "_grokparsefailure" not in [tags] { ... } if "_geoip_lookup_failure" not in [tags] [ .. }--> dont work

how to get rid of it ?

9

This is not true. It may not work the way you want it to, but it works.

10

it s true it s not working
if ("_grokparsefailure" not in [tags] or "_geoip_lookup_failure" not in [tags])
try it and you ll see in logstash's output

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.