I'd like to expand the logging to have more granular data available. However, the log format can't be updated on every instance, also in some cases, a backup restore will reset the changes. My issue is if I extend the grok pattern, it'll cause parse error for the fields not present in the current log format. Also, I would like not to rename the log itself.
Is there a way to set a conditional which won't result in a parse error?