Logstash Syntax :: Check Boolian Value within a Field?

Elastic Stack Logstash
1

Hi Logstash Ninjas,

In my filter{} section, I think I am creating a field with a Boolean value in it:

if SOME CONDITION {
  mutate {
    add_field => { "MyFlag" => 'true' }
    convert => { "MyFlag" => "boolean" }
  }
}
else {
  mutate {
    add_field => { "MyFlag" => 'false' }
    convert => { "MyFlag" => "boolean" }
  }
}

Later on, I want to check that flag:

if "MyFlag" == 'true' {
  mutate {
    add_field => { "Result" => "Boolean check worked!" }
  }
}
else {
  mutate {
    add_field => { "Result" => "Boolean check failed..." }
  }
}

In my tests, I’ve hard-coded MyFlag to always be TRUE. But that if() statement always fails. I can’t figure out the syntax should be. Any ideas?

2

Right now you are comparing the two strings "MyFlag" and "true" with each other. The correct syntax is
if [MyFlag] { ... }

3

mutate runs operations in a fixed order. add_field is part of decoration, which is the last thing done to the event. So at the time you try to convert it to boolean [MyFlag] does not exist.

Use two mutate filters in each branch.

4

Yes! You are so right. This worked perfectly. Thank you