Sprintf format in if statement

Elastic Stack Logstash
1

I try to use a sprintf format in a IF statement in output bloc but failled.

filter {
  mutate {
        add_field => { "systype" => "cpu" }
  }
}

output {
   if [event][dataset] == "system.%{systype}" {
    elasticsearch {
...

=> never go into the elastic output

filter {
  mutate {
        add_field => { "systype" => "cpu" }
  }
  mutate {
    add_field => { "systype2" => "system.%{systype}" }
  }
}

output {
   if [event][dataset] == [systype2] {
    elasticsearch {
...

=> It's OK

why ?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.