Grok filter if condition issue

Elastic Stack Logstash
1

Hi All,

how we can use if command in grok
some logs contain tag method
ex : "method" => "get" // I am able to parse the log
I want to add another field , if I am getting the log which is having tag called method
I was doing like but I am not able to do it , any idea where I am doing wrong

filter{
grok {
patterns_dir => "D:/log_file/patterns"
match => [ "message", "%{MASTER_LOG}" ]
}
if[ "method" in [tags]]
{

add_field => ["newtag", "manualtag"]

}
}

2

This isn't a grok question, it's a general filter question. This is probably what you're looking for:

filter {
  ...
  if "method" in [tags] {
    mutate {
      add_tag => ["newtag", "manualtag"]
    }
  }
}
2 Likes
3

@magnusbaeck Thank you :slight_smile: Working fine ..