How to use the field returned by sql for logstash if statement

320 views Asked by At

Sql statement

statement => "select ref_id,index_name,type,content from t_backup_es_data where backup_id >= :sql_last_value"

The value of the returned type column has a proposal and quotation

if[%{type}] == "quotation" {
        elasticsearch {
            hosts => "localhost:9200"
            index => "%{index_name}"
            document_type => "%{type}"
            document_id => "%{ref_id}"
            manage_template => true
            template_overwrite => true
            template => "../config/quotationMapping.json"
        }   
    }else if[%{type}] == "proposal" {
        elasticsearch {
            hosts => "localhost:9200"
            index => "%{index_name}"
            document_type => "%{type}"
            document_id => "%{ref_id}"
            manage_template => true
            template_overwrite => true
            template => "../config/proposalMapping.json"
        }
    }

This configuration does not working, what advice do you have?

1

There are 1 answers

0
Alain Collins On

Assuming you're using the JDBC input plugin, the doc states:

Columns in the resultset are converted into fields in the event

I'd start with a stdout output and see what you have. The ELK stack has used 'type' as an internal field in the past, so it might be as simple as renaming the column in your query.