Logstash mutate not working

Elastic Stack Logstash
1

Below are my 2 config file but when i add mutet it stops working

----------config 1

input {
tcp {
'port' => '9563'
}
}

filter {
json {
source => 'message'
}
mutate {
add_field => {
"componentId" => "%{component}"
}
}
if [component] == 1 {
mutate {
replace => [ "component", "datawarehouse" ]
}
}else if [component] == 2 {
mutate {
replace => [ "component", "Push Notification" ]
}
} else {
mutate {
replace => [ "component", "others" ]
}
}

}

config 2 for output

output {
elasticsearch { hosts => ["localhost:9200"] }
s3 {
access_key_id => ""
secret_access_key => ""
bucket => "elk-logs"
endpoint_region => "us-east-1"
size_file => "204800"
time_file => "5"
canned_acl => "private"
prefix => "pushnotification-logs/" }

    }
2

My logstash version is 2.1.1, can it cause problem.?

3

Which mutate cause the issue? What does the data look like?

4

Mutate replace is not working.. data sample message is as below

{
"_index": "logstash-2016.04.14",
"_type": "logs",
"_id": "AVQTJjuTjVrAZiFXntGJ",
"_score": null,
"_source": {
"message": "{"timestamp":"2016-04-14 00:02:31","message":"Android push zonea a","messageLevel":"INFO","component":2,"transactionId":0,"APP":"push_notification","ML":"hSH46306616","SENDER":"hSH80674580","S":"pass","TYPE":"chat_message","EndPt":"arn:aws:sns:us-east-1:238537778401:endpoint\/GCM\/com.shaadi_android\/83977239-962e-33cd-a954-e68eada8f9d0","MSG_TXT":"{\"data\":{\"message\":\"maam\",\"type\":\"CHAT\",\"pid\":\"hSH80674580\",\"display_name\":\"Shivendu G\",\"message_id\""} \r\n",
"@version": "1",
"@timestamp": "2016-04-14T05:02:32.912Z",
"host": "10.0.0.20",
"logTimestampString": "{"timestamp":"2016-04-14 00:02:31","message":"Android push zonea a","messageLevel":"INFO","component":2,"transactionId":0,"APP":"push_notification","ML":"hSH46306616","SENDER":"hSH80674580","S":"pass","TYPE":"chat_message","EndPt":"arn:aws:sns:us-east-1:238537778401:endpoint\/GCM\/com.shaadi_android\/83977239-962e-33cd-a954-e68eada8f9d0","MSG_TXT":"{\"data\":{\"message\":\"maam\",\"type\":\"CHAT\",\"pid\":\"hSH80674580\",\"display_name\":\"Shivendu G\",\"message_id\""} \r\n",
"tags": [
"_dateparsefailure"
]
},
"fields": {
"@timestamp": [
1460610152912
]
},
"sort": [
1460610152912
]
}

5

Why isn't the JSON string in message being parsed? Temporarily disable the elasticsearch and s3 outputs and add a stdout { codec => rubydebug } output so we can see what happens. Please post

  • the configuration that you consider working along with its output and
  • the configuration that doesn't work along with its output.
6

Hey, Mutate is working now I have upgraded logstash version not its working. Thanks for help.