Does the if statement works on the logstash input?
Any way to check if a field exists before doing the input? I like to do something like this:
input {
if [field] and [another_field] {
beats { ... }
}
}
So, the input will be enabled only if the fields "field" and "another_field" exists on the logs. I searched for a similar problem but couldn't find a solution.
I expect to enable the Logstash input component only if specific fields exist on the log. If this does not work, there's any workaround without dropping the log?
No, if statements do not work in the input section. The configuration compiler allows them, but appears to ignore them. The conditional cannot reference fields on the event because at the point where they are evaluated there is no event.
You will have to use a conditional and a drop {} in the filter section.