Unable to use if condition in logstash output section

Elastic Stack Logstash
1

Hi Team,
I am using file to inject two types of logs available on the same server via tcp port communication, since the log source is different i want two different indices to be created from logstash, which i am not able to achieve. I am copying my output section for your reference. need help on this.

Logstash output:

output {
  if [log_source] in [ "califfornia" , "newyork", "losangeles" ] {
   elasticsearch {
        hosts => [ "XXXXXXXXx:9200" ]
        user => "yyyyyyyyyy"
        password => "ppppppp"
        index => "usregion-log-%{log_source}-%{+YYYY.MM.dd}"
       }
  else if [log_source] in [ "england" , "india", "pakistan" ] {
   elasticsearch {
        hosts => [ "XXXXXXXXx:9200" ]
        user => "yyyyyyyyyy"
        password => "ppppppp"
        index => "intlregion-log-%{log_source}-%{+YYYY.MM.dd}"
       }  
    }
  stdout { codec => rubydebug }
}
2

What is the output to stout? Do you have the field you are using defined?

3

It looks like your first if statement is missing a closing bracket before the else?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.