Help on pastash conf file

[spady7]

I am trying to make working this configuration, but seams something is wrong.
Only "tags" CDR apply. Not AC_SYSLOG and also output not working based on IF statement.
Can you point me in the right direction?

input {
  udp {
    host => 0.0.0.0
    port => 9999
    tags => 'AC_SYSLOG'
type => 'sbc_logs'
  }
  udp {
    host => 0.0.0.0
    port => 514
    tags => 'CDR'
type => 'cdr'
  }
}

filter {
  if [type] == "sbc_logs"{
  app_audiocodes{
debug => true
}
  }
 
 
  if [type] == "cdr" {
  compute_field {
    field => origin
    value => "AUDIOCODES"
}
  json_fields {}
}
}

output {
 if [type] == "sbc_logs" {
    stdout {}
      hep {
        host => "heplify-server"
        port => 9060
        hep_id => 100
      }
   
  }
  else if [type] == "cdr" {
    stdout {}
    loki {
      host => "qryn"
      port => 3100
      path => "/loki/api/v1/push"
    }
  }
}

[lmangani]

Hey @spady7 could you describe your status a little better, showing examples of what works and what doesn't?

[spady7]

OK, got it.
I changed, for test, splitting configuration in 2 separate CONF files (as below):

input {
  udp {
    host => 0.0.0.0
    port => 514
    tags => 'CDR'
  }
}

filter {
  compute_field {
    field => origin
    value => "AUDIOCODES"
	}
  json_fields {}
}


output {
    stdout {}
	file {
		path => "/tmp/cdr_#{now:YYYY-MM}.log"
		serializer => json_logstash
	}
#    loki {
#      host => "qryn"
#      port => 3100
#      path => "/loki/api/v1/push"
#    }
  }

and

input {
  udp {
    host => 0.0.0.0
    port => 9999
    tags => 'AC_SYSLOG'
	type => 100
  }
}

filter {
  app_audiocodes{
	debug => true
	}
  }

output {
    stdout {}
	file {
		path => "/tmp/syslog_#{now:YYYY-MM}.log"
		serializer => json_logstash
	}
  }

Now as result i have 2 files (like output configured) but with same content. Why? Should be one with CDR content and one with SYSLOG content. Am I wrong?

[lmangani]

Nothing in the code or example would be able to do that. You must have other instances running or something with bad configs.

[spady7]

ohhh sorry. You mean, in my case I am running it in container, using 2 separate container?

[lmangani]

I can't tell without knowing how it's built, but you should be on the right path forward. Next time, best to open an issue ;)