Logstash on kubernetes. Multiple output conditions

Elastic Stack Logstash
1

Hi, guys!

I want to manipulate output indexes in my output section. The config example below don't work. I need insert data into one index when host_name index is present or another if not.
Field kubernetes.labels.devops_destination field in both condition should be == "logs"

output {
  if [vs-service] == "nameofservice" {
    elasticsearch {
      hosts => ["${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"]
      manage_template => false
      ssl_certificate_verification => false
      user => "user"
      password => "${PASSWORD}"
      index => "%{[vs_service]}_%{[accountcode]}"
    }
  }
  else if [kubernetes][labels][devops_destination] == "logs" and "" in [host_name] {
    elasticsearch {
      hosts => ["${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"]
      manage_template => false
      ssl_certificate_verification => false
      user => "user"
      password => "${PASSWORD}"
      index => "%{[kubernetes][labels][devops_destination]}-%{[host_name]}-%{+YYYY.MM.dd}"
    }
  }
  else if [kubernetes][labels][devops_destination] == "logs"  {
    elasticsearch {
      hosts => ["${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"]
      manage_template => false
      ssl_certificate_verification => false
      user => "user"
      password => "${PASSWORD}"
      index => "%{[kubernetes][labels][devops_destination]}-%{[kubernetes][namespace]}-%{+YYYY.MM.dd}"
    }
  }
  else {
    elasticsearch {
      hosts => ["${ELASTICSEARCH_HOST}:${ELASTICSEARCH_PORT}"]
      manage_template => false
      ssl_certificate_verification => false
      user => "user"
      password => "${PASSWORD}"
      index => "recyclebin-%{+YYYY.MM.dd}"
    }
  }
}
2

What do you think that means?

3

I think, this field is exist.
I looking for condition checking existence field and not null

4

I think you want

else if [kubernetes][labels][devops_destination] == "logs" and [host_name] {
5

But working just this condition:
else if [host_name] {
If I start using your example - stop working.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.