How to use the field returned by sql for logstash if statement

Question

Sql statement

statement => "select ref_id,index_name,type,content from t_backup_es_data where backup_id >= :sql_last_value"

The value of the returned type column has a proposal and quotation

if[%{type}] == "quotation" {
        elasticsearch {
            hosts => "localhost:9200"
            index => "%{index_name}"
            document_type => "%{type}"
            document_id => "%{ref_id}"
            manage_template => true
            template_overwrite => true
            template => "../config/quotationMapping.json"
        }   
    }else if[%{type}] == "proposal" {
        elasticsearch {
            hosts => "localhost:9200"
            index => "%{index_name}"
            document_type => "%{type}"
            document_id => "%{ref_id}"
            manage_template => true
            template_overwrite => true
            template => "../config/proposalMapping.json"
        }
    }

This configuration does not working, what advice do you have?

In my opinion, the separated Logstash instance will be better but also there is an answer to similar question https://stackoverflow.com/a/33820688/721600 — hkulekci, Nov 12 '18 at 13:22
@hkulekci Thank you for your reply. the link does not same as my question. I want to use a column value returned by the database as a condition for the if statement. — Jacky0312, Nov 12 '18 at 13:33

score 0 · Answer 1 · answered Nov 27 '18 at 21:39

Assuming you're using the JDBC input plugin, the doc states:

Columns in the resultset are converted into fields in the event

I'd start with a stdout output and see what you have. The ELK stack has used 'type' as an internal field in the past, so it might be as simple as renaming the column in your query.

How to use the field returned by sql for logstash if statement

1 Answers1