Output based on metadata field is not working

Elastic Stack Logstash
1
  • Version: 7.3
  • Operating System: Windows 10
  • Config File (if you have sensitive info, please remove it):
    filter {mutate {
    add_field => {
    "[@metadata][ingestInto]" => "${INGEST_INTO:true}"
    }
    }

}

output {

file {
    path => "test.json"
    write_behavior => overwrite
}

**if [@metadata][ingestInto] != "true" {** 
    http {
            http_method => "post"
            url => "XXXXX"
            format => "message"
            headers => {"Content-Type" => "application/json"}
            content_type => "application/json"
            message => '%{message}'
            pool_max => 100
            pool_max_per_route => 100
    }
}
**else if [@metadata][ingestInto] != "false" {**

    elasticsearch {
        hosts => "${ES_HTTP_HOSTS}"
        index => "itoa1"
        document_id => "%{key}"
        document_type => "data"
    }       

}

}

  • Sample Data:
    else if [@metadata][ingestInto] != "false" or true , always it trying to push data to elastic.
2

Use

output { stdout { codec => rubydebug { metadata => true } } }

What is the value of [@metadata][ingestInto]?

3

Setting the environment variable
set INGEST_INTO_JARVIS=true

mutate {
add_field => {
"[@metadata][ingestIntoJarvis]" => "${INGEST_INTO_JARVIS:true}"
} }

I have enable the output as suggested.

Nothing printed in [@metadata][ingestIntoJarvis] .

4

I cannot explain why the add_field would not occur.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.