New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make query_template option dynamic #90

Open
dadoonet opened this Issue Mar 18, 2018 · 0 comments

Comments

Projects
None yet
2 participants
@dadoonet
Copy link
Contributor

dadoonet commented Mar 18, 2018

May be not a so good idea but in my use case, I'd like to be able to do different kind of elasticsearch lookups depending on the input event values.

Ideally, I'd like to write something like:

filter {
	if [foo] {
	  mutate { add_field => { "template" => "search-by-foo.json" } }
	} else {
	  mutate { add_field => { "template" => "search-by-bar.json" } }		
	}

	elasticsearch {
	  query_template => "%{[template]}"
	  remove_field => ["template"]
	}
}

This is not supported yet as the elasticsearch filter checks at the pipeline creation time that %{[template]} file is available.

Would it be possible to support this?

Of course, I have a workaround but this makes me duplicate the elasticsearch filter twice:

filter {
	if [foo] {
		elasticsearch {
		  query_template => "search-by-foo.json"
		}
	} else {
		elasticsearch {
		  query_template => "search-by-bar.json"
		}
	}
}

It looks a nice workaround but when the elasticsearch filter configuration is more complex (more options), that's "a lot" of lines of code to duplicate. Here I have also only 2 type of searches but we can think about more than that as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment