Logstash output: If field exists, use other index

Hi all,

I want to use an other index, if a specific field exists...

My output-config looks like this:

output {
  if [kubernetes.namespace] {
    elasticsearch {
            hosts => "my-elastic.local:9200"
            index => "kubernetes-%{+YYYY.MM.dd}"
  } else {
    elasticsearch {
            hosts => "my-elastic.local:9200"
            index => "logstash-%{+YYYY.MM.dd}"

Any ideas, why this is not working? Unfortunately it's using the "else" output (= index => "logstash-%{+YYYY.MM.dd}")

Strangely enough, I see that field "kubernetes.namespace" in Kibana...

Logstash version: 6.3.0


1 Like

That should probably be

if [kubernetes][namespace] {

that easy... thank you, problem solved! :blush:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.