logstash的conditional语句（if语句出错）

来源：互联网发布：知美整形是正规医院吗? 编辑：程序博客网时间：2024/06/15 23:07

语句的基本形式：
条件判断

使用条件来决定filter和output处理特定的事件。logstash条件类似于编程语言。条件支持if、else if、else语句，可以嵌套。
条件语法如下：

if EXPRESSION {  ...} else if EXPRESSION {  ...} else {  ...}

比较操作有：
相等: ==, !=, <, >, <=, >=
正则: =~(匹配正则), !~(不匹配正则)
包含: in(包含), not in(不包含)
布尔操作：
and(与), or(或), nand(非与), xor(非或)
一元运算符：
!(取反)
()(复合表达式), !()(对复合表达式结果取反)
语句的具体用法请参照参考url

使用中遇到的问题：
1、if[foo] in "String"在执行这样的语句是，报错如下：

Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<TypeError: can't convert nil into String>, "backtrace"=>["org/jruby/RubyString.java:4462:in `include?'", "(eval):97:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):95:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):68:in `filter_func'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:267:in `filter_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:265:in `filter_batch'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:223:in `worker_loop'", "/opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:201:in `start_workers'"], :level=>:error}TypeError: can't convert nil into String       include? at org/jruby/RubyString.java:4462     initialize at (eval):97           each at org/jruby/RubyArray.java:1613     initialize at (eval):95           call at org/jruby/RubyProc.java:281    filter_func at (eval):68   filter_batch at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:267           each at org/jruby/RubyArray.java:1613         inject at org/jruby/RubyEnumerable.java:852   filter_batch at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:265    worker_loop at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:223  start_workers at /opt/logstash-2.3.4/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:201

原因是没有找到叫做foo的field，无法把该字段值转化成String类型。所以最好要加field if exist判断。

2、判断字段是否存在，代码如下：

if ["foo"] {  mutate {    add_field => "bar" => "%{foo}"  }}

http://www.ttlsa.com/elk/elk-logstash-configuration-syntax/
http://stackoverflow.com/questions/36947535/logstash-conditional-statement-in-input-block
http://stackoverflow.com/questions/30309096/logstash-check-if-field-exists
http://stackoverflow.com/questions/21438697/logstash-conditional-to-check-if-tag-exists

0 0