# Logstash の output elasticsearch ブロック内で if 分岐して index 名を動的に変更したい

**URL:** <https://discuss.elastic.co/t/logstash-output-elasticsearch-if-index/356538>\
**Category:** 日本語による質問・議論はこちら\
**Created:** [April 1, 2024, 10:24am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-if-index/356538 "2024-04-01T10:24:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![k-nishigaki](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@k-nishigaki](https://discuss.elastic.co/u/k-nishigaki)\
**Post date:** [April 1, 2024, 10:24am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-if-index/356538/1 "2024-04-01T10:24:12Z")

</div>

現在、client (elastic-agent) =\> Logstash (整形) =\> Elasticsearch という構成を検証しています。

複数のサーバからまず elastic-agent (filebeats) で Logstash サーバ向けにログを転送、  
Logstash サーバでは必要に応じて filter を行って Elasticsearch へ送信、  
ということを考えています。

以下のような設定をしようとしたところ、syntax error になってしまいました。  
output の elasticsearch ブロックの中では event の内容などは使えないのでしょうか？

```auto
input {
  elastic_agent {
    port => 5044
    enrich => none
  }

}

filter {
  if "test" in [tags] {
    ruby {
      path => "/path/to/test.rb"
    }
  }
}

output {
  elasticsearch {
    hosts => [
      "https://host1.example.com:9200",
      "https://host2.example.com:9200",
      "https://host3.example.com:9200"
    ]
    if "test" in [tags] {
      index => "test-%{+YYYY.MM.dd}"
    } else {
      index => "default-%{+YYYY.MM.dd}"
    }
    user => "username"
    password => "password"
  }
}

```

エラーメッセージ

```auto
Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 28, column 8 (byte 449)

```

なお、同様の if 文を elasticsearch ブロックの中ではなく外に記載した場合は期待通りに index 名を分けることができたのですが、  
それだと index 毎に elasticsearch ブロックを記載する必要が出てしまい、なんとか index 名だけ動的に変更したいと考えています。

各バージョン

- Elasticsearch : 8.12.1
- Logstash : 8.13.0
- elastic-agent : 8.13.0

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [April 1, 2024, 10:37am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-if-index/356538/2 "2024-04-01T10:37:39Z")

</div>

Try:

```auto
output {
  elasticsearch {
    if "test" in [tags] {
      hosts => ["https://host1.example.com:9200", "https://host2.example.com:9200", "https://host3.example.com:9200"]
      index => "test-%{+YYYY.MM.dd}"
      user => "username"
      password => "password"
    } 
    else {
      hosts => ["https://host1.example.com:9200", "https://host2.example.com:9200", "https://host3.example.com:9200"]
      index => "default-%{+YYYY.MM.dd}"
      user => "username"
      password => "password"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![k-nishigaki](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@k-nishigaki](https://discuss.elastic.co/u/k-nishigaki)\
**Post date:** [April 2, 2024, 1:18am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-if-index/356538/3 "2024-04-02T01:18:58Z")

</div>

No change, it seems.

```auto
[2024-04-02T10:17:19,694][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:elastic-agent, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 23, column 8 (byte 285) after output {\n elasticsearch {\n if ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:239:in `initialize'", "org/logstash/execution/AbstractPipelineExt.java:173:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "org/jruby/RubyClass.java:931:in `new'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:49:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:386:in `block in converge_state'"]}

```

---

<div class="post-metadata">

**Author:** ![k-nishigaki](https://avatars.discourse-cdn.com/v4/letter/k/e56c9b/32.png) [@k-nishigaki](https://discuss.elastic.co/u/k-nishigaki)\
**Post date:** [April 2, 2024, 2:28am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-if-index/356538/5 "2024-04-02T02:28:23Z")

</div>

以下のような形で自己解決しました

```auto
input {
  elastic_agent {
    port => 5044
    enrich => none
  }

}

filter {
  if "test" in [tags] {
    ruby {
      path => "/path/to/test.rb"
    }
    mutate {
      "add_field" => { "index_name" => "test" }
    }
  } else {
    mutate {
      "add_field" => { "index_name" => "default" }
    }
  }
}

output {
  elasticsearch {
    hosts => [
      "https://host1.example.com:9200",
      "https://host2.example.com:9200",
      "https://host3.example.com:9200"
    ]
    index => "%{index_name}-%{+YYYY.MM.dd}"
    user => "username"
    password => "password"
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 30, 2024, 2:29am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-if-index/356538/6 "2024-04-30T02:29:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.