Update OpenTrafficPipeline.conf

Author: Chris Wiechmann

logstash/pipelines/OpenTrafficPipeline.conf

@@ -25,11 +25,11 @@ filter {
     add_field => { "[@metadata][ignoreField][policyName]" => "" } # and policyName used for ingoreLookup
   }
   # First, is to check if the document should be ignored/dropped (configured based on the apiPath or PolicyName)
-  if([transactionSummary]) {
+  if([transactionSummary] and [transactionSummary][path]) { # Only if a path is given (not given for instance for Scheduled-Policies)
     mutate { replace => { "[@metadata][ignoreField][apiPath]" => "%{[transactionSummary][path]}" } }
-  } else if ([transactionElement]) {
+  } else if ([transactionElement] and [transactionElement][protocolInfo][http][uri]) { # uri is not given for Non-HTTP legs
     mutate { replace => { "[@metadata][ignoreField][apiPath]" => "%{[transactionElement][protocolInfo][http][uri]}" } }
-  } else if ([circuitPath]) {
+  } else if ([circuitPath] and [circuitPath][0][policy]) { # Policy is for instance not given for OPTIONS requests
     mutate { replace => { "[@metadata][ignoreField][policyName]" => "%{[circuitPath][0][policy]}" } }
   } else { # For everything else (e.g. JMS-Legs) perform no lookup (Set the default to not ignore)
     mutate { add_field => { "[isIgnoreAPI][ignore]" => "false" } }