Use a conditional into another one

Hello,

I would like to use a conditional in my logstash.conf output.

The idea is to send data to two different cluster

output{
if [theXML][measValue][r][p]==[theXML][measType][p]{
if "demo" in [team] {
elasticsearch
{
action => "index"
hosts => ["ip1:9200","ip2:9200","ip3:9200"]
index => "sdl-%{team}-%{SDL}-%{+YYYY.MM.dd}"
}
}
else {

elasticsearch
{
action => "index"
hosts => ["host4:9200","host5:9200","host6:9200"]
index => "sdl-%{team}-%{SDL}-%{+YYYY.MM.dd}"
}
}
}
}

I am getting an error when using this configuration:

`

[2019-09-02T04:53:09,780][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, ", ', -, [, / at line 119, column 14 (byte 3158) after output{\nif [theXML][measValue][r][p]==[theXML][measType][p]{\nif "demo" in ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:in map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in block in converge_state'"]}

Thank you for your help

`

That part of the configuration looks fine, which suggests there may be an error earlier in the configuration (a missing close quote, for example).

1 Like

Yes, there was a mistake in the other part. Thanks ^^

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.