Add field dynamically based on different match

Elastic Stack Logstash
1

We'd like to add an index based on which pattern was actually hit, which looks like this, but it won't work:

filter {
  grok {
    patterns_dir => "./patterns"
    match => {
      "message" => "%{A}"
    }
    add_field => { 'type' => 'A' }
  }
  grok {
    patterns_dir => "./patterns"
    match => {
      "message" => "%{B}"
    }
    add_field => { 'type' => 'B' }
  }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.