Unable to set sub-condition in condition

Elastic Stack Logstash
1

Hello folks,

I am fighting with one problem in logstash.

I would like to set a sub-condition in existing condition.

if [type] == "system" {
    mutate {
      rename => { "instCpu"  => "cpuTotal" } 
      rename => { "sysCpu"  => "cpuUsed" } 
      rename => { "sysMemTotal"  => "memoryTotal" } `Preformatted text`
      rename => { "sysMem"  => "memoryUsed" } 
      rename => { "instMem"  => "memoryFree" } 
    }
  } else if [type] == "transaction" {
      if [legs][0][serviceName] == nil {
        mutate { add_field => { "serviceName" => "%{[legs][0][uri]}" } }
      } else {
        mutate { add_field => { "serviceName" => "%{[legs][0][serviceName]}" } }
      }
  }

But I am getting error:

[2019-02-21T12:28:29,246][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Expected one of #, ( at line 41, column 40 (byte 921) after filter {\n json {\n source => \"message\"\n }\n\n# mutate { \n# remove_field => [ \"message\" ] \n# }\n\n date {\n match => [ \"time\",\"UNIX_MS\" ]\n target => \"@timestamp\"\n remove_field => [ \"time\" ]\n }\n\n mutate {\n add_field => { \"sourceSystem\" => \"cag\" }\n add_field => { \"sourceEnvironment\" => \"dev\" }\n add_field => { \"sourceType\" => \"gbs\" }\n add_field => { \"sourceName\" => \"GBS DEV\" }\n }\n\n\n if [type] == \"system\" {\n mutate {\n rename => { \"instCpu\" => \"cpuTotal\" } \n rename => { \"sysCpu\" => \"cpuUsed\" } \n rename => { \"sysMemTotal\" => \"memoryTotal\" } \n rename => { \"sysMem\" => \"memoryUsed\" } \n rename => { \"instMem\" => \"memoryFree\" } \n }\n } else if [type] == \"transaction\" {\n if [legs][0][serviceName] == nil "}

I have tried to find the proper syntax in documentation but without success.

Have you any idea how to fix this?

I have logstash-5.5.1

Thanks a lot
Regards, Reddy

2

Are you trying to test whether that field exists? If so you just need

if [legs][0][serviceName] {
    [...]
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.