Not loading pipeline - ConfigurationError

I've updated the output of our pipeline to change the index that some documents get added to but I'm getting a configuration error when trying to start Logstash, I can't for the life of me find what I'm missing. I'm using version 7.15.2.

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "localhost:9200"
      manage_template => false
      if [service][type] == "postgres" {
        index => "%{[@metadata][beat]}-postgres-%{+YYYY.MM.dd}"
      } else {
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      }
      pipeline => "%{[@metadata][pipeline]}"
    }
  } else {
    elasticsearch {
      hosts => "localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    }
  }
}

and the error:

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"=>\" at line 50, column 10 (byte 1031) after output {\n#  if [file] or [url] { \n#    stdout { codec => rubydebug }\n#  }\n  if [@metadata][pipeline] {\n    elasticsearch {\n      hosts => \"localhost:9200\"\n      manage_template => false\n      if ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:391:in `block in converge_state'"]}

Thank you all for your help.

You cannot have an conditional inside an output plugin config. What you could do in the filter section is

   if [@metadata][pipeline] {
       if [service][type] == "postgres" {
         mutate { add_field => { "[@metadata][indexName]" => "%{[@metadata][beat]}-postgres-%{+YYYY.MM.dd}" } }
       } else {
         mutate { add_field => { "[@metadata][indexName]" => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" } }
       }
     }
   } else {
       mutate { add_field => { "[@metadata][indexName]" => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" } }
   }

then change all your outputs to use index => "%{[@metadata][indexName]}"

Awesome. Thanks @Badger, I'll fix that up now. And thank you for the super fast reply too :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.