Logstash filter only particular fields and index those fields

[venkatesh_prasanth]

Hi,

I have heartbeat which pushed the data to 5044 through which logstash consumes.
I want to index only if monitor.status is down. I am using tag heartbeat for differentiating the various beat input.

My data:
{
"_index": "heartbeat-2022.04.26",
"_type": "_doc",
"_id": "18",
"_version": 1,
"_score": null,
"fields": {
"monitor.status": [
"down"
],
"monitor.name.text": [
"prasanth"
],

[venkatesh_prasanth]

i tried with prune but it is not whitelisting the nested field

[Cad]

Hi,

If i understand corretly, if monitor.status is not equal to down, then you don't send data.
Then use drop filter in a conditionnal like this:

if [monitor.status][0] != "down" {
  drop { }
}

Cad.

[venkatesh_prasanth]

hey cad,
Thanks, Tried that but it seems it dropping all data to the index

[Cad]

@venkatesh_prasanth

it dropping all data to the index

well that's what you mean when you ask us previously :

@venkatesh_prasanth

I want to index only if monitor.status is down

[Badger]

logstash does not use the same syntax as kibana and Elasticsearch to reference nested fields. You may want if [monitor][status][0] != "down" {

[venkatesh_prasanth]

Even it's dropping down status

[venkatesh_prasanth]

@Badger

if [monitor][status][0] != "down" {

hi ...
if [monitor][status][0] != "down" { does not worked but if [monitor][status] != "down" {
worked.

Thanks both