If you are creating the tags field in Logstash using add_tag, then it is an array, a collection type field, so you need to use the in or not in operator.
What you have in reality is tags: [ "average_weight", "other-tags" ]
Hi @leandrojmp basically i introduced this tags in filebeat.yml
- type: filestream
# Change to true to enable this input configuration.
enabled: true
tags: ["average_weight"]
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /home/aniket/python/average_weight.log
according to me logstash will check that this field(when it receive events from beats) is exist and it has the value
So i am creating tag but i am using this tags.. Please correct me
Tag is a field which can contains multiple values as the array.
if "average_weight" in [tags] means check does the values "average_weight" exist in tags if [tags] == "average_weight" means check is tags equal to "average_weight", which never be possible since is the array, not a value.
What is possible to compare is a member of the array, for instance: if [tags][0] == "average_weight"
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.