Logstash Action

Elastic Stack Logstash
1

I'm currently upgrading logstash + elasticsearch from 7.x to 8.x but am getting this error within the logstash pipeline

[WARN ][logstash.outputs.elasticsearch][main][790066835755a2e9e8ffb361aa7273a3b82493ee370893269ac96e8138475316] Elasticsearch doesn't support [%{[@metadata][action]}] action;

In my pipeline i have the following

filter {
if [auditActivity] == "I" or [auditActivity] == "U" {
    mutate { add_field => { "[@metadata][action]" => "index" } }
  } else if [auditActivity] == "D" {
    mutate { add_field => { "[@metadata][action]" => "delete" } }
  } 

mutate { 
  remove_field  => ["auditId", "auditActivity"]
  }
}

output { 
  elasticsearch {
    action => "%{[@metadata][action]}"
    document_id => "%{[id]}"
  }
 
}

This works fine in our current production environment on 7.x, but on my test on 8.x it doesn't seem to like it

2

You need to share the rest of your pipeline and some sample message so people may try to replicate your issue.

The warning you get means that the field %{[@metadata][action]} wasn't populate with any value, your conditional that adds the value index or delete to it didn't work for this specific message.

You may have an error in your parse and your filter needs to be changed, but you need to provide your pipeline and some sample message.

3

I found the issue was due to this

As we are also moving from SQL Server -> Postgres it seems there are differences, updating the statement and it's working correctly now with escaping the quotes