This is my preferred filter to capture "error" from the tag that is added in the 'input' as part of filebeat. This filter fails. filter { if "error" in [tags] { grok { match => [ 'message', '^.*=%{INT:_nrings}^.*=%{INT:_phone}^.*=%{WORD:_informat}^.*=%{INT:_tries}^.*=%{INT:_callT…

How do I test my condition statement that is not working?

newmember April 5, 2020, 2:29am 5

Thanks
I have updated the question to ask why my condition statement is not working and how to correct it.

Topic		Replies	Views
Logstash if statement not working probably Logstash	2	2361	December 25, 2015
Can't make conditionnal filtering to work Logstash	7	1413	December 5, 2016
Grok parse faliure filebeat 6.0 Logstash	5	588	January 2, 2018
Conditional filtering not working in logstash Logstash	13	5611	March 6, 2019
Conditional being ignored for grok match Logstash	3	1100	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How do I test my condition statement that is not working?

Related topics