Logstash mutate if condition


(Ankit Kumar) #1

I have some log value that comes randomly i used mutate plugin for sperate the data from json.

      "role" => "OFR Expert MIC NSRU N3 | Admin_Read",
     "eventSource" => "[ajp-nio-9798-exec-6] INFO  com.orange.csr.aspect.Logging",
          "rating" => "4",
       **"question2" => "%{[parsedJson][[input[0]][questionAnswers[1]][question]]}"**

on the last value as you can see its print parameter if value is not exist in log. i wanted if my value not exist in log its print null or skip this index rather printing the parameter.

Please is my logstash configuration file.

input {

beats {
port => "5001"
}

}

filter {
if[type] == "csrnextgen-logs" and "_grokparsefailure" not in [tags]{
if [message] =~ "FEED" {
grok {
match => { "message" => "%{DATA:eventSource}\ - %{DATA:timeStamp}| %{GREEDYDATA:request}" }
}
json{
source => "request"
target => "parsedJson"
remove_field=>["request"]
}
mutate {
add_field => {
"timestamp" => "%{[parsedJson][timestamp]}"
"loglevel" => "%{[parsedJson][loglevel]}"
"user" => "%{[parsedJson][user]}"
"role" => "%{[parsedJson][role]}"
"mco" => "%{[parsedJson][mco]}"
"service" => "%{[parsedJson][service]}"
"logtype" => "%{[parsedJson][logtype]}"
"operationdetails" => "%{[parsedJson][operationdetails]}"
"status" => "%{[parsedJson][status]}"
"duration" => "%{[parsedJson][duration]}"
"rating" => "%{[parsedJson][[input[0]][rating]]}"
"question1" => "%{[parsedJson][[input[0]][questionAnswers[0]][question]]}"
"answers1" => "%{[parsedJson][[input[0]][questionAnswers[0]][answers]]}"
}
}
if "[parsedJson][[input[0]][questionAnswers[1]][question]]" {
mutate {
add_field => ["question2","%{[parsedJson][[input[0]][questionAnswers[1]][question]]}"]
remove_field => [ "message", "parsedJson" ]
}
}
}else if "_grokparsefailure" in [tags]{
drop{}
} else {
drop{}
}
}
}
output {
stdout { codec => rubydebug }
}

Please help me to resolve this issue.


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.