Hello All,
Kindly suggest if something wrong I'm doing here.
Logstash: 8.8.2
I have two indices: mis-monitoring-webserver and mis-monitoring-webui.
- I want some additional fileds to be created based on some condition satisfield and go to mis-monitoring-webui index.(For this if :else used in filter)
2)Now in output filter data never goes to mis-monitoring-webui index.
3)Now if IF-ELSE (mis-monitoring-webui) is removed for output filter the data goes to first index i.e mis-monitoring-webserve
4)I want the entire data to go to first index (WEBSERVER) and on condition meet on applied filter- new fields to be created and only that should go to NEW INDEX-(WEBUI)
I tried debugging, stuck now.
Note in second index: webui only the required fields should come and not whole object data(i.e only required fields)
input {
exec {
command => '$ABCD_APP/mis/monitoring/scripts/monitoring_core.ksh -c $ABCD_CONFIG_DIR/mis/globalconfiguration.properties -e ac_tomcat_monitoring.pl'
schedule => "*/10 * * * * *"
}
}
filter {
split {}
if [message] =~ "^\{.*\}[\s\S]*$" {
json {
source => "message"
target => "parsed_json"
remove_field => "message"
}
split {
field => "[parsed_json][mis]"
target => "tomcat"
remove_field => [ "parsed_json" ]
}
# Check for critical conditions and add fields accordingly
if [tomcat][memory_status] == "Critical" or [tomcat][error_status] == "Critical" or [tomcat][request_status] == "Critical" or [tomcat][server_status] == "DOWN" {
mutate {
add_field => {
"UsecaseStatus" => "Critical"
"UsecaseCategory" => "Tomcat"
}
}
} else {
# Set default values if no critical conditions
mutate {
add_field => {
"UsecaseStatus" => "Normal"
"UsecaseCategory" => "Tomcat"
}
}
}
}
else {
drop { }
}
}
output {
elasticsearch {
hosts => "https://abc:443"
ilm_pattern => "{now/d}-000001"
ilm_rollover_alias => "mis-monitoring-webserver"
ilm_policy => "mis-monitoring-common-policy"
api_key => ""
ssl_enabled => true
ssl_certificate_authorities => ""
http_compression => true
data_stream => false
}
# Conditional block to redirect events based on UsecaseStatus field
if [UsecaseStatus] == "Critical" {
elasticsearch {
hosts => "https://abc:443"
ilm_pattern => "{now/d}-000001"
ilm_rollover_alias => "mis-monitoring-webui"
ilm_policy => "mis-monitoring-common-policy"
api_key => ""
ssl_enabled => true
ssl_certificate_authorities => ""
http_compression => true
data_stream => false
doc => {
"UsecaseStatus" => "%{UsecaseStatus}"
"UsecaseCategory" => "%{UsecaseCategory}"
}
}
} else {
elasticsearch {
hosts => "https://abc:443"
ilm_pattern => "{now/d}-000001"
ilm_rollover_alias => "mis-monitoring-webui"
ilm_policy => "mis-monitoring-common-policy"
api_key => ""
ssl_enabled => true
ssl_certificate_authorities => ""
http_compression => true
data_stream => false
doc => {
"UsecaseStatus" => "Normal"
"UsecaseCategory" => "Tomcat"
}
}
}
}
