Hi, I'm trying to apply a tag based on the contents of a field. I've been trying it like this: if [field.keyword] =~ /^(TEST|test)-.*$/ { mutate { add_tag => [ "TEST" ] } } } The above does not work, the tag never gets applied even though the contents of the field looks like this…

The .keyword field does not exist until the data is ingested into elasticsearch. In logstash you should test if [KundID-SiteID] =~ /^(TEST|test)-.*$/ {

Regexp in conditional

Elastic Stack Logstash

Badger August 9, 2019, 12:59pm 10

You are using syslog output and input to move events between logstash instances? I would suggest switching to a lumberjack output and a beats input. If you are really married to syslog you can do something like this to send the entire event.

Topic		Replies	Views
Logstash if condition regex not working Logstash	11	1136	August 29, 2022
Conditional Input based on Regex Logstash	5	8885	January 8, 2018
If condition regex error Logstash	2	356	February 10, 2021
Logstash conditional test for value in a field Logstash	2	372	November 10, 2020
How to put condition based on certain string in [message]? Logstash	7	17432	May 8, 2018

Regexp in conditional

Related Topics