Quick question on type

Elastic Stack Logstash
1

So per 2.4.0 breaking changes type is no workie in filter/output now. I currently have a logstash config with this structure:

input {
        file {
                type => "log"
        }
}

filter {
        if ( [type] == "log" and [message] !~ "bleh" ) {
                drop { }
        } else {
do stuff
}

and it's working with logstash beta. Is this still considered type use in the filter plugin configuration setting? Thanks.

2

Type isn't deprecated in the way you're thinking.

Here's what it actually means. In older versions of Logstash, before there were any conditionals, you would do this:

input {
  plugin {
    setting => value
    type => "mytype"
  }
}

filter {
  grok { 
    match => { "fieldname" => "%{GROKPATTERN:msg}" }
    type => "mytype"
  }
}

Note that type in the bad grok filter example above is used as a conditional, so that only messages of type "mytype" are processed.

Now that Logstash has conditionals, type is redundant, and has been removed.

Using type as a regular field for evaluation within conditionals is 100% okay.

3

Perfect...totally explains it...thanks as always Aaron :slight_smile: