Logical expression in pipeline


(Bogdan) #1

Hi
could someone explain logical expression in pipeline? The case is, for example Output section:

output {
if "C" in [tags] and [filed_A] = A or "C" in [tags] and [filed_B] = B
elasticsearch {}
}

Second match group doesn't work. Logstash won't catch event.
What would be right syntax to use matching in tags and fields?


(Magnus B├Ąck) #2

The equality operator is ==, not =.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals


(Bogdan) #3

My bad.
I'm using == But it doesn't solve problem.
Event won't go to specified index.

Even more, if using
"C" in [tags]
more that 1 time in expression, the whole expression doesn't work.

So, do I have to use several elseif constructions with the same elasticsearch output configuration?


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.