Hi All,
I need to run multiple logstash config files on a single instance, for which i need to use, in each config file types. Each config file must have a different type or else the config files will step on each other. Reference : Combining Multiple Config Files
When I try to do the same, the condition for filter plugin is ignored.
Here is my Config file:
input {
jdbc {
jdbc_driver_library => "\sqljdbc4-4.0.jar"
jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
jdbc_connection_string => "link"
jdbc_user => "xyz"
jdbc_password => "xyz"
statement => "---SELECT statement--"
type => "test"
}
}
filter {
if [type] == "test" {
aggregate {
task_id => "%{id}"
code => "
map['country_name'] = event.get('country_name')
map['towns'] ||= []
map['towns'] << {'town_name' => event.get('town_name')}
event.cancel()
"
push_previous_map_as_event => true
timeout => 3
}
}
}
output {
if [type] == "test" {
elasticsearch
{
index => "xyz"
document_type => "abc"
document_id => "%{id}"
action => "index"
hosts => "localhost:9200"
manage_template => true
template=>"template.json"
template_overwrite => true
}
}
}
The data in the output clearly is not nested/aggregate filter hasnt worked. Please help me with the above issue, am i missing something?