Grok Expression in If condition Filter

Elastic Stack Logstash
1

Is it possible to use Grok Expression with in If condition

i.e.

filter
{
if ([message] = /^%{TIMESTAMP_ISO8601}) (i.e. if line starts with ISO8601 Timestamp it needs to execute different condition)
{
grok (some condition)
}
else if ([message] = /^%{CATALINA_DATESTAMP}) (i.e. if line starts with CATALINA data time format, it needs to execute different condition)
{
grok(some condition)
}

I tried this condition, however I am not getting expected result at the same time I am not getting any error.

Thanks,
Kamesh.

2

Is it possible to use Grok Expression with in If condition

No, it is not.

I tried this condition, however I am not getting expected result at the same time I am not getting any error.

Why would you get an error? The string is still a valid regular expression, it's just that it doesn't match like you expect it to.

(But if grok patterns in regexp match expressions did work, the fact that you're escaping the percent sign at the beginning of the string probably would've prevented it from working.)

3

Got it, thanks. Now, I am using the same condition in grok filter:

input
{
file
{
path => "/tmp/osb_server.log"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => multiline
{
pattern => "(^####)|(^[%{TIMESTAMP_ISO8601})|(^<%{CATALINA_DATESTAMP})|(^%{YEAR}-%{MONTHNUM}-%{MONTHDAY})"
negate => "true"
what => previous
}
type => "osb_server.log"
}
}
filter
{
grok
{
match => ["message", "(?^#.{3})",
"message", "^[%{TIMESTAMP_ISO8601:logType2}]",
"message", "^<%{CATALINA_DATESTAMP:logType3}",
"message", "(?<logType4>^%{YEAR}-%{MONTHNUM}-%{MONTHDAY})"]
break_on_match => false
tag_on_failure => []
}
mutate
{
remove_field => ["@version"]
}
}
output {
elasticsearch {
hosts => ["192.168.99.100:9200"]
}
stdout { codec => rubydebug }
}

Is this the right approach? i get different types of logs and I am using the same configuration file, whenever it sees a line starting with any of the above condition provided then it needs to create the variables accordingly. Based on the variables I am planning to write conditions.

4

Yes, this looks reasonable. I'm assuming your multiline pattern actually contains \| and not just |. Always post your configuration formatted as code to avoid this kind of time-wasting ambiguity.

5

Thanks, I will.