Logstash - Accessing Event Data and Fields in the Configuration - Conditionals

Elastic Stack Logstash
1

I'm trying to follow Accessing Event Data and Fields in the Configuration | Logstash Reference [6.2] | Elastic and I have a question:

output:

output {
  if [beats_input_raw_event] in [tags] or [beats_input_codec_plain_applied] in [tags] {
    ...

is there a way to configure "if tags exists" somehow? instead of specifying each tags?

Please advise.

2 
if [beats_input_raw_event] in [tags] or [beats_input_codec_plain_applied] in [tags] {

That doesn't mean what you think it means. Do this instead:

 if "beats_input_raw_event" in [tags] or "beats_input_codec_plain_applied" in [tags] {

is there a way to configure "if tags exists" somehow? instead of specifying each tags?

You mean "does the event have any tags at all"? This should work:

if [tags] != [] {
3

I did like this:

if [tags] {

and it works)

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.