Not in tags condition

Elastic Stack Logstash
1

Hello I am trying to ingest into Elasticsearch if the documents dont have couple of tags, but some how still the documents are getting persisted if the tags present. below is my code .The tags with "_split_type_failure" are still getting ingested into ES.

output {
if "_xmlparsefailure" not in [tags] or "_split_type_failure" not in [tags] {
elasticsearch {
hosts =>
index =>""
}
}
}

2

Do you get what you want if you replace or with || ?

3

Do you get what you want if you replace or with || ?

I'd expect a syntax error. or is the correct operator for logical OR.

4

You should probably use and instead of or. As it stands, an event with a _split_type_failure tag will be indexed unless it also has an _xmlparsefailure tag.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.