Issue with ingestion pipeline with conditional

Elastic Stack Elasticsearch
, ,
1

Hello, I am trying to parse and compare values through ingest pipeline, but couldn't do it,
I was running below code, grok is running fine, but couldn't be able to compare value in set condition.

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": ["%{HOSTNAME:host.name},%{WORD:host.driveletter},%{INT:host.driveusage}"]
        },
        "set": {
          "field": "summary.down",
          "value": 1,
          "if": "ctx.host.name == 'CALCWZ88C3'"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "CALCWZ88C3,C,13"
      }
      
    }
    
  ]
}

getting below issues

{
  "docs": [
    {
      "error": {
        "root_cause": [
          {
            "type": "script_exception",
            "reason": "runtime error",
            "script_stack": [
              "ctx.host.name == 'CALCWZ88C3'",
              "        ^---- HERE"
            ],
            "script": "ctx.host.name == 'CALCWZ88C3'",
            "lang": "painless",
            "position": {
              "offset": 8,
              "start": 0,
              "end": 29
            }
          }
        ],
        "type": "script_exception",
        "reason": "runtime error",
        "script_stack": [
          "ctx.host.name == 'CALCWZ88C3'",
          "        ^---- HERE"
        ],
        "script": "ctx.host.name == 'CALCWZ88C3'",
        "lang": "painless",
        "position": {
          "offset": 8,
          "start": 0,
          "end": 29
        },
        "caused_by": {
          "type": "null_pointer_exception",
          "reason": "cannot access method/field [name] from a null def reference"
        }
      }
    }
  ]
}

Could you please help ?

I have one more question , is there < and > than operators in ingest pipeline you can use, if yes please what's the syntax, I have to compare value which comes from grok output

2

This looks like a possible duplicate. Please see that answer.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.