Conditional apply of filter

Elastic Stack Logstash
1

Hi,

Trying to parse different kinds of log files and output to ES but seems like the condition gets ingnored by logsash when applying filters and I get some error. Any ideas what could be going wrong?

this is the structure of my config file

if [type] == "type1" {
json {

    }                                                                                                                                                                                                                                                                                             
                                                                                                                                                                                                                                                                           
} else if [type] == "type2"  {                                                                                                                                                                                                                     
    grok {                                                                                                                                                                                                                                                                                        
    
 }                                                                                                                                                                                                                                                                                        
}else if [type] == "type3"{                                                                                                                                                                                                                                                                
                                                                                                                                                                                                                                                                                                  
                                                                                                                                                                                                                                                                                                  
    csv {                                                                                                                                                                                                                                                                                         
                                                                                                                                                                                                                                                                      
    }                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
                                                                                                                                                                                                                                                                                                  
}

I get grock parse errors for files of type3 though im not applying grok filter to the type.

2

Do you have multiple files in /etc/logstash/conf.d? Is there an unconditional grok filter in one of the other files?

1 Like
3

Yes I do have multiple files in the conf.d. dir. Looked at all but grok was being applied conditionally there too. Seems like just a tag though. Able to see actual problem in the log though, mapper parsing exception
Still trying to figure that

4

Eventually found rogue grok filters in other files. Thanks