Hi All,
how we can use if command in grok
some logs contain tag method
ex : "method" => "get" // I am able to parse the log
I want to add another field , if I am getting the log which is having tag called method
I was doing like but I am not able to do it , any idea where I am doing wrong
filter{
grok {
patterns_dir => "D:/log_file/patterns"
match => [ "message", "%{MASTER_LOG}" ]
}
if[ "method" in [tags]]
{
add_field => ["newtag", "manualtag"]
}
}