Hi all,
I'm attempting to place a conditional statement in morphline (in order to
only process the syslog records that contain JSON data. However, I can
never get a match:
Here is the code snippet that I've written.
{ setValues { message_string : "test message" } }
# only perform conversion on certain records
{
if {
conditions : [
{ contains { message_string : "test" } }
]
then : [
{ logDebug { format : "matched" } }
]
else : [
{ logDebug { format : "not matched" } }
]
}
}
{ setValues { message_string : [] } }
And here is the information from the log file:
28 Mar 2014 05:48:19,779 DEBUG [pool-8-thread-1]
(com.cloudera.cdk.morphline.stdlib.ContainsBuilder$Contains.doProcess:86)
- Contains command failed because it could not find any of [test] in
values: [test message] for command: {
# /etc/flume-ng/conf/morphline.conf: 22
"message_string" : "test"
}
28 Mar 2014 05:48:19,782 DEBUG [pool-8-thread-1]
(com.cloudera.cdk.morphline.base.AbstractCommand.process:161) - Command
failed!
28 Mar 2014 05:48:19,786 DEBUG [pool-8-thread-1]
(com.cloudera.cdk.morphline.stdlib.LogDebugBuilder$LogDebug.log:63) - not
matched
I know the syntax is correct, as the tcp syslog source would not start if
it was busted. Can anyone suggest why it's not matching?
Regards,
Andrew S
--
Andrew Sammut
Lead Reliability Engineer (AUS)
Mobile: +61 (0)435 072 784
Google Voice: +1 (415) 548 1927
Email: [email protected]
Skype: kix.asammut
