Logstash string equality test weirdness

Elastic Stack Logstash
1

Hi,

Logstash version: logstash-5.1.2-1.noarch
Java version: Oracle JRE 1.8.0_111
OS: Oracle Linux 7.2

I am trying to use an environment variable to control a beat input configuration. To illustrate the issue below, I have configured beats to open one or another port number based on a conditional (I've also dropped the environment variable out of the config as it's not needed to demonstrate). If I run this code, logstash listens on BOTH port numbers!

input {
  if 'false' == 'true' {
    beats {
      port                        => 5044
    }
  }
  else {
    beats {
      port                        => 5045
    }
  }
}

Netstat output:

tcp6       0      0 :::5044                 :::*                    LISTEN      6909/java            off (0.00/0/0)
tcp6       0      0 :::5045                 :::*                    LISTEN      6909/java            off (0.00/0/0)

Does the 'if/else' construct depend on a field being on one side of the equality? Or am I just having a blonde moment?

Thanks,
Nick

2

I don't think the input block supports conditionals, which is why both inputs are created. I am surprised it is not throwing an error though. Static settings like this, that do not depend on event data, are in my experience often managed through orchestration tools.

3

Hi Christian,

Thanks for the quick response.

I am a using an orchestration tool (puppet) to set the environment variables for logstash. Our logstash config is in a separate git repository, so cannot be directly modified by hiera etc.

Do you know if such a feature is on the radar? The reason we need to be able to do this is to control what SSL cert to use based on an environment variable. In the meantime, I can probably work around this by using a symlink.

Cheers,
Nick

4

Why not store a template config file in git and have Puppet replace variables with appropriate values when deploying the file?

5

Hi Christian,

Unfortunately, making local modifications to the files in the git repo will likely break future syncs (using the rcsrepo resource in Puppet). However, your suggestion has made me realise that I can control most of the parameters to the beats input with environment variables, meaning I don't need an 'if-else' block at all. I imagine it will only work with string parameters (not arrays or hashes), but I think that's all I need.

Thanks for your help!
Nick

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.