在 logstash 中使用条件

Question

Has anyone ever added a conditional to an input? I'm using various versions of the beats plugin. Versions less than 7.11 don't have @metadata I'd like to use two different indicies conditionally. For example,

15    beats {
16         port => "5000"
17         codec => "plain"
18         ssl => true
19         ssl_certificate_authorities => ["/etc/pki/logstash/logstashCA.pem"]
20         ssl_certificate => "/etc/pki/logstash/logstashCA.pem"
21         ssl_key => "/etc/pki/logstash/logstashCA.p8"
22         ssl_verify_mode => "force_peer"
23         if [version] not in [beat] {
24                 add_field => { "target_index" => "%{[@metadata][beat]}-%{[beat]}-7-%{+YYYY.MM.dd}" }
25         }
26         add_field => { "target_index" => "%{[@metadata][beat]}-%{[beat][version]}-%{+YYYY.MM.dd}" }
27    }

Answer 1

No, you cannot have a conditional based on fields of the event in an input because at the time the input is built no events exit. However you can do it in the filter section

if [beat][version] {
    add_field => { "target_index" => "%{[@metadata][beat]}-%{[beat][version]}-%{+YYYY.MM.dd}" }
} else {
    add_field => { "target_index" => "%{[@metadata][beat]}-%{[beat]}-7-%{+YYY
}