Read a CSV in Logstash level and filter on basis of the extracted data

[Gurkeerat_Sondhi]

I am using Metricbeat to get process-level data and push it to Elastic Search using Logstash.

Now, the aim is to categorize the processes into 2 tags i.e the process running is either a browser or it is something else.

I am able to do that statically using this block of code :

    input {
      beats {
        port => 5044
      }
    }
    filter{
        if [process][name]=="firefox.exe" or [process][name]=="chrome.exe" {
            mutate {
                add_field => { "process.type" => "browsers" }
                convert => {
                "process.type" => "string"
                }
            }
        }
        else {
            mutate {
                add_field => { "process.type" => "other" }
            } 
        }
    }

    output {
      elasticsearch {
        hosts => "localhost:9200"
        # manage_template => false
        index => "metricbeatlogstash"
      }
    }

But when I try to make that if condition dynamic by reading the process list from a CSV, I am not getting any valid results in Kibana, nor an error on my LogStash level.

The CSV config file code is as follows :

    input {
      beats {
        port => 5044
      }
      file{
            path=>"filePath"
            start_position=>"beginning"
            sincedb_path=>"NULL"
        }
    }
    filter{
        csv{
            separator=>","
            columns=>["processList","IT"]
        }
        if [process][name] in [processList] {
            mutate {
                add_field => { "process.type" => "browsers" }
                convert => {
                "process.type" => "string"
                }
            }
        }
        else {
            mutate {
                add_field => { "process.type" => "other" }
            } 
        }
    }

    output {
      elasticsearch {
        hosts => "localhost:9200"
        # manage_template => false
        index => "metricbeatlogstash2"
      }
    }