Variable value is not accesible in nested if condition

In a nested if condition like
if [type] == "tcp"{
if [parsed_message][NotificationType] == "NOTIFY"

The if block inside "tcp" is not working since it is not getting the value of "[parsed_message][NotificationType]" but if i give the same condition like
if [parsed_message][NotificationType] == "NOTIFY" and [type] == "tcp"{
It is working fine, what is the problem here ?

Please show an example of a document that has this perceived problem so that we can try to reproduce it.


In this above example i am not able to use the notification type in nested if

That doesn't help without also knowing your configuration. I meant the document produced by Logstash, i.e. basically the input to the conditional that's not working. Use a stdout { codec => rubydebug } output.

What does the full configuration block look like? It seems like you are missing a curly brace on the second line, but I assume that could simply be a cut and paste error.

xml {
store_xml => true
source => message
target => parsed_message
force_array => false
remove_field => "message"

This is my code block to parse the xml. The output block is

if [type] == "tcp"{ if [parsed_message][NotificationType] == "NOTIFY" { elasticsearch { } } }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.