Use environment variable to control output


From the logstash.conf, I want to control the output based on the environment variable. I have tried the following, but it does not work. I find the use of the environment variable is not consistent throughout the configuration file. Is there any good reference on this?


output {
    if "${LS_OUTPUT_DEBUG:0}" == 1 {
        # debugging
        file {
            path => "${LOGS_DIR}/output-debug-%{+YYYYMMdd}.log"
            codec => "rubydebug"

Not that I know of. Does it help you to do this?

mutate { add_field => { "[@metadata][LS_DEBUG]" => "${LS_DEBUG:0}" "[@metadata][LOGS_DIR]" => "${LOGS_DIR}" } }

Hi Badger.

I don't have an issue with the LOGS_DIR. Only the LS_OUTPUT_DEBUG does not work. I support the use of environment variable for conditionals is not supported

Thanks for the suggestion. It works for the LS_OUTPUT_DEBUG now. Wondering if there is a more efficient way.

if [@metadata][LS_DEBUG] {
    # debugging
    file {
        path => "${LOGS_DIR}/restccu-debug-%{+YYYYMMdd}.log"
        codec => "rubydebug"

Say, if I want to use an environment variable to control the filter, does it mean I will have to use mutate with add_field at the very beginning of the filter section?

You can use a single mutate+add_field to import everything from the environment.

I suppose that is the only way. Thanks again. :smile:

Hmm. I think I might have spoken too soon. It does not actually work. When I set the LS_OUTPUT_DEBUG=0, it still generates the output file. I am not certain what Logstash sees the value of this environment variable. Is there any way to debug the configuration file?

That is testing whether the field exists, which it always does.

Yep. I was suspecting that also so I have changed to

if [@metadata][LS_OUTPUT_DEBUG] == 1 {

Do the "export LS_OUTPUT_DEBUG=1", then start the logstash.
However, there is still no output file generated.

mutate+add_field never generates integers, you need to use "1" there.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.