Using Multiple IF conditionals in Filter

setlem · October 24, 2016, 8:04am

if [CREATION_DATE] == ""
{
mutate {
convert => [ "CREATION_DATE", "string" ]
}
}
else
{
date {
locale => "en"
match => [ "CREATION_DATE", "dd-MMM-yy hh.mm.ss.SSS a"]
target => "CREATION_DATE"
}
}

  if [SUBMITTED_DATE] == "" 
 {
   mutate {
            convert => [ "SUBMITTED_DATE", "string" ]
          }
 }
 else
 {
   date {
   locale => "en"
   match => [ "SUBMITTED_DATE", "dd-MMM-yy hh.mm.ss.SSS a"]
   target => "SUBMITTED_DATE"
        }
 }	

 if [LAST_MODIFIED_DATE] == ""
 {
 mutate {
            convert => [ "LAST_MODIFIED_DATE", "string" ]
      }
 }
 else
 {
   date {
   locale => "en"
   match => [ "LAST_MODIFIED_DATE", "dd-MMM-yy hh.mm.ss.SSS a"]
   target => "LAST_MODIFIED_DATE"
       }
 }

am getting output if i have all three (CREATION_DATE,SUBMITTED_DATE,LAST_MODIFIED_DATE) in date format.If any is STRING am not getting that log file in my output.
for ex:
my input is

12-JUL-13 11.33.56.259 AM,12-JUL-13 03.59.36.136 PM,12-JUL-13 04.00.05.584 PM
14-JUL-13 11.33.56.259 AM,11-JUL-13 04.00.05.584 PM
my output will come successfully for
12-JUL-13 11.33.56.259 AM,12-JUL-13 03.59.36.136 PM,12-JUL-13 04.00.05.584 PM but NOT FOR 2nd line

In Simple,Logstash is indexing only when three if clauses have dates.
Help me out.THanks in advance!!

magnusbaeck · October 24, 2016, 11:28am

I suggest you edit your post and move it to the Logstash category since it's a Logstash question.

setlem · October 24, 2016, 11:39am

Thanks magnus.

setlem · October 25, 2016, 1:34am

sorry to trouble friends.
As am new and don't know anyone to guide me about logstash expect this forum.

But right now am getting
"LogStash::ConfigurationError" it is like this. logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-2.0.6/lib/logstash/filters/mutate.rb:192:in register'" and "org/jruby/Ruby rray.java:1613:in each
This errors i am getting with same config file as provided above
Thanks!!

magnusbaeck · October 25, 2016, 5:36am

I don't think you're using exactly the configuration that you've posted before. What do your mutate filters look like?