Add field when line contains EXCEPTION

[alex_vermex]

Hi,
logstash read the file line by line and add each line to Elasticsearch ok but i just want to add it with a condition when he find "EXCEPTION".
example of my log file:

01/01/2022 15:00:02 546- MAIN EXCEPTION : 
System.IO.IOException: Unable.......
    at System ......
    at System ....
01/01/2022 15:00:03 535- S....
01/01/2022 15:00:03 535- GA.....

I want to send just the "exception" to Elasticsearch.

Any help would be sincerely appreciate!
Thanks.

[Badger]

Sounds like you want something like

if "EXCEPTION" in [message] { mutate { add_field => { "someField" => "someValue" } } }

[Tomo_M (Tomohiro Mitani)]

Or if you want to drop other messages than EXCEPTION, it could be:

if !("EXCEPTION" in [message]) {drop{}}

[alex_vermex]

Thanks Badger,TOMO_M

That's what i want, and if i want to add another condition before the drop ? i tried this but didn't work:

if !("EXCEPTION" and "System.Net.Sockets" in [message]) {drop{}}

Thanks.

[Tomo_M (Tomohiro Mitani)]

About conditional syntax, see here.

[alex_vermex]

Thanks Tomohiro.