Hello,
I would like to use a conditional in my logstash.conf output.
The idea is to send data to two different cluster
output{
if [theXML][measValue][r][p]==[theXML][measType][p]{
if "demo" in [team] {
elasticsearch
{
action => "index"
hosts => ["ip1:9200","ip2:9200","ip3:9200"]
index => "sdl-%{team}-%{SDL}-%{+YYYY.MM.dd}"
}
}
else {
elasticsearch
{
action => "index"
hosts => ["host4:9200","host5:9200","host6:9200"]
index => "sdl-%{team}-%{SDL}-%{+YYYY.MM.dd}"
}
}
}
}
I am getting an error when using this configuration:
`
[2019-09-02T04:53:09,780][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, ", ', -, [, / at line 119, column 14 (byte 3158) after output{\nif [theXML][measValue][r][p]==[theXML][measType][p]{\nif "demo" in ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in
compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in
compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:inblock in compile_sources'", "org/jruby/RubyArray.java:2577:in
map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:incompile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in
initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in
initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:inexecute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in
block in converge_state'"]}
Thank you for your help
`