Logstash Syntax :: Check Boolian Value within a Field?

Hi Logstash Ninjas,

In my filter{} section, I think I am creating a field with a Boolean value in it:

if SOME CONDITION {
  mutate {
    add_field => { "MyFlag" => 'true' }
    convert => { "MyFlag" => "boolean" }
  }
}
else {
  mutate {
    add_field => { "MyFlag" => 'false' }
    convert => { "MyFlag" => "boolean" }
  }
}

Later on, I want to check that flag:

if "MyFlag" == 'true' {
  mutate {
    add_field => { "Result" => "Boolean check worked!" }
  }
}
else {
  mutate {
    add_field => { "Result" => "Boolean check failed..." }
  }
}

In my tests, I’ve hard-coded MyFlag to always be TRUE. But that if() statement always fails. I can’t figure out the syntax should be. Any ideas?

Right now you are comparing the two strings "MyFlag" and "true" with each other. The correct syntax is
if [MyFlag] { ... }

mutate runs operations in a fixed order. add_field is part of decoration, which is the last thing done to the event. So at the time you try to convert it to boolean [MyFlag] does not exist.

Use two mutate filters in each branch.

Yes! You are so right. This worked perfectly. Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.