logstash if statement within output

linuxfix picture linuxfix · Jun 25, 2015 · Viewed 8k times · Source

This simple config file has an error. I've tried everything I can think of to fix it. I've simplified this example. Ultimately I'd like to use multiple input files and send them to different ports on the output.

input {
  file {
    path => "/home/user/log/*"
    type => "test1"
    start_position => "beginning"
  }
}

output {
  syslog {

    host => "server.com"

    if [type] == "test1" {
      port => 5555
    }

    severity => "informational"
    facility => "syslogd"
  }
}

The error is:

Error: Expected one of #, => at line 14, column 8 (byte 168) after output {
  syslog {

    host => "server.com"

    if

logstash is running on ubuntu:

apt --installed list|grep logstash
logstash/stable,now 1.4.3-1-7e387fb all [installed]

Answer

linuxfix picture linuxfix · Jun 25, 2015

I found the problem. I needed to move "syslog" like this:

output {
  if [type] == "test1" {
    syslog {
      host => "server.com"
      port => 5555
      severity => "informational"
      facility => "syslogd"

    }
 }
}