Variable value is not accesible in nested if condition


(Raja Gopal) #1

In a nested if condition like
if [type] == "tcp"{
if [parsed_message][NotificationType] == "NOTIFY"

The if block inside "tcp" is not working since it is not getting the value of "[parsed_message][NotificationType]" but if i give the same condition like
if [parsed_message][NotificationType] == "NOTIFY" and [type] == "tcp"{
It is working fine, what is the problem here ?


(Magnus Bäck) #2

Please show an example of a document that has this perceived problem so that we can try to reproduce it.


(Raja Gopal) #3

<NotificationTime><![CDATA[1505469213]]></NotificationTime><NotificationType><![CDATA[CLEAR]]></NotificationType><OccurrenceCount><![CDATA[4]]></OccurrenceCount><Severity><![CDATA[1]]></Severity>

In this above example i am not able to use the notification type in nested if


(Magnus Bäck) #4

That doesn't help without also knowing your configuration. I meant the document produced by Logstash, i.e. basically the input to the conditional that's not working. Use a stdout { codec => rubydebug } output.


(Christian Dahlqvist) #5

What does the full configuration block look like? It seems like you are missing a curly brace on the second line, but I assume that could simply be a cut and paste error.


(Raja Gopal) #6

xml {
store_xml => true
source => message
target => parsed_message
force_array => false
remove_field => "message"
}

This is my code block to parse the xml. The output block is

if [type] == "tcp"{ if [parsed_message][NotificationType] == "NOTIFY" { elasticsearch { } } }


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.