Logstash output: If field exists, use other index

Elastic Stack Logstash
1

Hi all,

I want to use an other index, if a specific field exists...

My output-config looks like this:

output {
  if [kubernetes.namespace] {
    elasticsearch {
            hosts => "my-elastic.local:9200"
            index => "kubernetes-%{+YYYY.MM.dd}"
    }
  } else {
    elasticsearch {
            hosts => "my-elastic.local:9200"
            index => "logstash-%{+YYYY.MM.dd}"
    }
  }
}

Any ideas, why this is not working? Unfortunately it's using the "else" output (= index => "logstash-%{+YYYY.MM.dd}")

Strangely enough, I see that field "kubernetes.namespace" in Kibana...

Logstash version: 6.3.0

Thanks!

1 Like
2

That should probably be

if [kubernetes][namespace] {
4 Likes
3

that easy... thank you, problem solved! :blush:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.