Problem with conditional in output definition

I started experimenting with metricbeat and wanted the data in the index that the sample dashboards expect, so I tried settting the index conditionally on the input type. logstash complains that it is an invalid configuration, but I think I am doing what the documentation says. Here is how I define the output


elasticsearch {
hosts => "localhost"
if [type] == "metricsets" {
index => "metricbeat-%{+YYYY.MM.dd}"
} else {
index => "logstash-%{+YYYY.MM.dd}"
}
}
Is it broken or did I miss something in the documentation? "bin/logstash --version" tells me I am running "logstash 5.1.1". The error message I get ends with

:reason=>"Expected one of #, => at line 22, column 6 (byte 586) after output {\n\t# stdout { codec => "rubydebug" }\n\telasticsearch {\n\t\thosts => "localhost"\n\t\tif "}

I don't want to post the entire error message because it contains the SSL keystore and truststore passwords unobfuscated, which is a whole other problem.

You can't have conditionals inside the plugin definitions. Do this instead:

if [type] == "metricsets" {
  elasticsearch {
    hosts => "localhost"
    index => "metricbeat-%{+YYYY.MM.dd}"
  }
} else {
  elasticsearch {
    hosts => "localhost"
    index => "logstash-%{+YYYY.MM.dd}"
  }
}
2 Likes

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.