Event field in logstash output

Hi, in my logstash config in output part I have sns settings:
sns { region => “eu-west-1” arn => “xxxx” }
It works but every event has inside field called “SNSregion” that contains region (we get it from user gui…). So I need to put this field into sns settings. But both of ways doesn’t work…
sns { region => [SNSregion] arn => “xxxx” }
sns { region => “%{SNSregion}” arn => “xxxx” }
It shows error:
[2018-01-16T10:13:08,497][ERROR][logstash.agent ] Cannot create pipeline {:reason=>“Something is wrong with your configuration.”}

[2018-01-16T10:13:34,202][ERROR][logstash.outputs.sns ] Invalid setting for sns output plugin:
output {

sns {

This setting must be a [“us-east-1”, “us-east-2”, “us-west-1”, “us-west-2”, “eu-central-1”, “eu-west-1”, “eu-west-2”, “ap-southeast-1”, “ap-southeast-2”, “ap-northeast-1”, “ap-northeast-2”, “sa-east-1”, “us-gov-west-1”, “cn-north-1”, “ap-south-1”, “ca-central-1”]

Expected one of [“us-east-1”, “us-east-2”, “us-west-1”, “us-west-2”, “eu-central-1”, “eu-west-1”, “eu-west-2”, “ap-southeast-1”, “ap-southeast-2”, “ap-northeast-1”, “ap-northeast-2”, “sa-east-1”, “us-gov-west-1”, “cn-north-1”, “ap-south-1”, “ca-central-1”], got ["%{SNSregion}"]

region => “%{SNSregion}”



}

}
It looks like logstash doesn’t take sns region field as variable. I am sure the value is there. How should I wrote it?

Thanks!

You will need to use a if conditional block in your output section. The region setting is applied when LS boots up not per event.
Adjust as necessary.

output {
  if [SNSregion] == "us-east-1" {
    sns {
      region => "us-east-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-east-2" {
    sns {
      region => "us-east-2" arn => "xxxx"
    }
  } else if [SNSregion] == "us-west-1" {
    sns {
      region => "us-west-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-west-2" {
    sns {
      region => "us-west-2" arn => "xxxx"
    }
  } else if [SNSregion] == "eu-central-1" {
    sns {
      region => "eu-central-1" arn => "xxxx"
    }
  } else if [SNSregion] == "eu-west-2" {
    sns {
      region => "eu-west-2" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-southeast-1" {
    sns {
      region => "ap-southeast-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-southeast-2" {
    sns {
      region => "ap-southeast-2" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-northeast-1" {
    sns {
      region => "ap-northeast-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-northeast-2" {
    sns {
      region => "ap-northeast-2" arn => "xxxx"
    }
  } else if [SNSregion] == "sa-east-1" {
    sns {
      region => "sa-east-1" arn => "xxxx"
    }
  } else if [SNSregion] == "us-gov-west-1" {
    sns {
      region => "us-gov-west-1" arn => "xxxx"
    }
  } else if [SNSregion] == "cn-north-1" {
    sns {
      region => "cn-north-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ap-south-1" {
    sns {
      region => "ap-south-1" arn => "xxxx"
    }
  } else if [SNSregion] == "ca-central-1" {
    sns {
      region => "ca-central-1" arn => "xxxx"
    }
  } else {
    # when all else fails, send to this region
    sns {
      region => "eu-west-1" arn => "xxxx"
    }
  }
}

Thanks! But that really not nice way to do it :smiley:

I know. :disappointed:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.