Using "fields.type" in logstash 7.6

Elastic Stack Elasticsearch
1

Upgrading from 5.6 to 7.6, how can i use the "fields.type" in logstash to filter out data and also in output section. We had "type" field earlier configured however i believe its not longer supported now.

input {
  beats {
    port => 5044
  }
  beats {
    port => 5045
  }
}
filter {
  if [fields.type] == "inf_os_logs" {
  grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp}" }
    }
# }
}

output {
  if [type] == "inf_os_logs" {
    elasticsearch {
      hosts => ["XXXXX"]
      #index=> "%{type}"
      index=> "inf_%{[fields][type]}_logs"
      user => "XXXX"
      password => "XXXX"
     }
  }
}

I am able to get the logs fine with the "field.type" correct in elasticsearch however the logstash doesn't seem to like it for some reason and sort of drops it there.

2

Checking if anyone has any ideas ?

3

For anyone who is struggling like me, i was able to use it this way

if [fields][type] == "string"

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.