Not add field if jdbc_static plugin lookup fail

Elastic Stack Logstash
1

I have a jdbc_static config as below.
How can I not add field if lookup failed or don't have matched record.
Can I specify if else statement for add fields?

  jdbc_static {
    loaders => [
      {
        id => "host_info"
        query => "SELECT [Name],[ShortDescription],[Description],[OwnerName],[Site],[Model] ,[Status] FROM [MonitoringPortal].[dbo].[tb_RemedyServerListing] WITH (nolock)"
        local_table => "host_info"
      }
    ]
    local_db_objects => [
      {
        name => "host_info"
        index_columns => ["Name"]
        columns => [
          ["Name", "varchar(50)"],
          ["ShortDescription", "varchar(256)"],
          ["Description", "varchar(256)"],
          ["OwnerName", "varchar(256)"],
          ["Site", "varchar(50)"],
          ["Model", "varchar(50)"],
          ["Status", "varchar(50)"]
        ]
      }
    ]
    local_lookups => [
      {
        query => "select * from host_info WHERE UPPER(Name) LIKE UPPER(:host)"
        parameters => { host => "%{[monitor][host]}" }
        target => "hostname"
      }
    ]
    # using add_field here to add & rename values to the event root
    add_field => { "[sd][name]" => "%{[hostname][0][name]}"}
    add_field => { "[sd][shortdescription]" => "%{[hostname][0][shortdescription]}"}
    add_field => { "[sd][Description]" => "%{[hostname][0][description]}"}
    add_field => { "[sd][ownername]" => "%{[hostname][0][ownername]}"}
    add_field => { "[sd][site]" => "%{[hostname][0][site]}"}
    add_field => { "[sd][model]" => "%{[hostname][0][model]}"}
    add_field => { "[sd][status]" => "%{[hostname][0][status]}"}

    remove_field => ["hostname"]
    staging_directory => "/tmp/import_data"
    loader_schedule => "5 *  * * *" # run loaders every 2 hours
    jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
    jdbc_driver_library => "mssql-jdbc-7.0.0.jre8.jar"

Empty result:

    "sd": {
      "Description": "%{[hostname][0][description]}",
      "site": "%{[hostname][0][site]}",
      "shortdescription": "%{[hostname][0][shortdescription]}",
      "model": "%{[hostname][0][model]}",
      "ownername": "%{[hostname][0][ownername]}",
      "name": "%{[hostname][0][name]}",
      "status": "%{[hostname][0][status]}"
    }
2

Maybe you can choose one of those examples to process your mutate section if field exists or contain a certain value:

if [sd]{
#enters here if the sd contains data
}

if [sd][name]{
#enters if the sd.name exists
}

if [sd][name] and [sd][site] or [sd][model]{
#enters there if two objects exists and one optional
}

if [sd][name] =~ /yourvalue/{
#enters if sd.name contains yourvalue
}
3

Seems like you cannot use if statement for add_field inside jdbc_static filter plugin

4

I was aiming to match those fields outside of the plugin.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.