Comparing Empty String

Hi,

I am not able to compare empty string and do the necessary operation in logstasgh. Below is my logstash config file line

if [fields][type] == "serverlog"{
grok {
match => {"message"=> "%{DATE:log_date}%{SPACE}%{TIME:log_time}%{SPACE}%{LOGLEVEL:level}%{SPACE}[%{DATA:class}]%{SPACE}%{GREEDYDATA:Log_message}"}
}

if [message][class] == "" {
drop {}
}

Please guide me to figure out the wrong. Thank you in advance

It is not nested so you can just use

if [class] == "" {
drop {}
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.