Can we add field in _grokparsefailure if block?

Elastic Stack Logstash
1

is it possible like below?

if "_grokparsefailure" in [tags] {
add_field => ["exceptionClass", "other"]
drop {}
}

right now it is throwing error.

2

Put the add_field line inside a mutate filter.

But what's the point of adding a tag to an event if you're deleting it on the next line?

3

sorry i mentioned drop by mistake. i dont wanna drop that line, just add a new field in case match fails.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.