Logstash Comparing Field Values Using an If Statement not working

Elastic Stack Logstash
1

Hi,

I am trying to compare two fields using the following method but it is not working. I have used it before using an older version of logstash and it worked but it is not working on logstash 7.9.2.

Logstash cannot be able to compare values in two different fields:

Example:
old_user = john
new_user = john

Will result in the creation of the field_change field even though the fields have the same value.

Below is the code:

    if [old_USER] != "%{new_USER}" {
          mutate {
              add_field => { "field_change" => "user" }
         }
    }
2

Why not use

if [old_USER] != [new_USER] {
1 Like
3

This worked. Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.