Logstash adding tag issue

Elastic Stack Logstash
1

We had given a task as

Try adding tag A if the data read is a.

a
b
a
c
d

Ensure that the input data is tagged with type as a test, and write the output to the file output.txt in the path usr/share/logstash .

For which we have written the code as below, but could not complete the task, please help us -

input { 
  beats {
      port => 5044
}
        stdin { 
                tags => ["A"] 
                type => "test"
                } 
        } 

filter {
if "a" in [tags] {
       {
      separator => ","
      columns =>["a","b","c","d"]
    }
}
}
output {
if "a" in [tags] {
    stdout {
            codec => "rubydebug"
    }
   file {
      path => "/usr/share/logstash/output.txt"
   }
    elasticsearch {
    }
}
}
2

please help us on it. we tried below code also not working -

input {
  stdin {
    type => 'test'
  }
}
filter {
  if [type] = 'test' {
    mutate {
     add_tag => [ "A" ]
    }
  }
}
output {
  stdout {
    codec => 'rubydebug'
  }
   file {
      path => "usr/share/logstash/output.txt"
   }
}
3

"A" and "a" are different. For the other one,

That should be ==, not just =.

4

We had tried

input {
   stdin {
     type => 'test'
   }
 }
 filter {
   if [type] == 'test' {
     mutate {
      add_tag => [ "A" ]
     }
   }
 }
 output {
   stdout {
     codec => 'rubydebug'
   }
    file {
       path => "usr/share/logstash/output.txt"
    }
 }

still not working

5

Perhaps Missing the leading / path need to be absolute

Perhaps you could just send to standard out to check the output

6

still not working

7

I took this config.

input {
   stdin {
     type => 'test'
   }
 }
 filter {
   if [type] == 'test' {
     mutate {
      add_tag => [ "A" ]
     }
   }
 }
 output {
   stdout {
     codec => 'rubydebug'
  
   }
   file {
       path => "/Users/sbrown/workspace/elastic-install/7.9.1/logstash-7.9.1/output.txt"
    }
 }

ran this command

$ echo "Test Data" | ./bin/logstash -f config/test.conf

This was my output on stdout.
.....

    {
        "@timestamp" => 2020-10-12T04:15:39.217Z,
              "tags" => [
            [0] "A"
        ],
              "host" => "ceres",
              "type" => "test",
          "@version" => "1",
           "message" => "Test Data"
    }
    [2020-10-11T21:15:39,503][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
    [2020-10-11T21:15:39,587][INFO ][logstash.outputs.file    ][main][494100533301f78e41c77d45b207aa556b6645c623bf67a642d4d67e5d3ee6b0] Opening file {:path=>"/Users/sbrown/workspace/elastic-install/7.9.1/logstash-7.9.1/output.txt"}
    [2020-10-11T21:15:40,867][INFO ][logstash.runner          ] Logstash shut down.

and then

$ cat output.txt 
{"@timestamp":"2020-10-12T04:15:39.217Z","tags":["A"],"host":"ceres","type":"test","@version":"1","message":"Test Data"}

Works fine ... perhaps it would help if you posted your logstash output so we could see what is actually happening.

9

thanks it worked

1 Like
10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.