Open gui66497 opened 4 years ago
And in another filter:
filter {
if [status][state] == "down" {
elasticsearch {
user => elastic
password => changeme
...
}
}
}
I get another error:
Error: Parse error on line 23:
... } if [status][state] == "down" {
---------------------^
Expecting 'START', 'CONDITION_OPERATOR', 'BINARY_OPERATOR', 'PARENTHESIS_STOP', got 'ARRAY_START'
Seem the paser only support one value. I never touch the jison paser before,so can i solve this kind problem by edit the paser?
My origin filter:
the parser seem to can not understand it and throw an error:
Does the jison paser just do not support this? So i have to change my conditon to if [ipv4] != null?