Documentation for accepted conditionals syntax in logstash filter


(Valugi) #1

I failed to find the full documentation on how to use conditionals inside filter block. Is this syntax valid:

filter {
  if [tags] == "A" and [tags] == "B" {
    grok {
      ....
  }
}

or should I use if "A" in [tags]. Logstash does not mind the first but does not produces the desired outcome either.
Thanks


(Valugi) #2

Found it: https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.