Using "fields.type" in logstash 7.6

Upgrading from 5.6 to 7.6, how can i use the "fields.type" in logstash to filter out data and also in output section. We had "type" field earlier configured however i believe its not longer supported now.

input {
  beats {
    port => 5044
  }
  beats {
    port => 5045
  }
}
filter {
  if [fields.type] == "inf_os_logs" {
  grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp}" }
    }
# }
}

output {
  if [type] == "inf_os_logs" {
    elasticsearch {
      hosts => ["XXXXX"]
      #index=> "%{type}"
      index=> "inf_%{[fields][type]}_logs"
      user => "XXXX"
      password => "XXXX"
     }
  }
}

I am able to get the logs fine with the "field.type" correct in elasticsearch however the logstash doesn't seem to like it for some reason and sort of drops it there.

Checking if anyone has any ideas ?

For anyone who is struggling like me, i was able to use it this way

if [fields][type] == "string"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.