How to filter events based on certain string?

Elastic Stack Logstash
1

Hi,

I am trying to filter out events if it contains either source_type=\”APP/PROC/WEB\” or source_type=APP in the event.

Can someone please help me on this?

Thanks

2

If I understand the question correctly then

if [source_type] in [ 'APP', '"APP/PROC/WEB"' ] { drop {} }
3

Hi,

But source_type is not a field. Basically, I am trying to search for the entire strings source_type=\”APP/PROC/WEB\” or source_type=APP in [message] field.

4

Thanks for clarifying

 if [message] =~ /source_type="APP\/PROC\/WEB"|source_type=APP/ ...
5

Thanks for the answer. Can you please say if I have to use escape character \ for double quotes and forward slashes. Please let me know if following is correct.

if [message] =~ /source_type=\"APP\/PROC\/WEB\"|source_type=APP/{
drop{}
}
6

Yes for forward slashes, because the right hand side of =~ is a regexp that starts and ends with a forward slash. No for double quotes. If it were a string starting and ending with double quotes rather than a regexp it would be the other way around.

7

Thanks Badger. It's working perfectly fine with what I have mentioned above. But if I use another if condition, it's not working,

if [message] =~ /source_type=\"APP\/PROC\/WEB\"|source_type=APP/{
     grok{...}
}
if [message] =~ /event_type=ContainerMetric/{
     grok{...} 
}
else{
     drop{}
}

Please say what I am doing wrong.

8

Any message that matches the first if will be dropped if it does not match the second if. Is that what you want? Or did you mean to do if - else if - else?

You do not say what you mean by "not working". What does the message look like (send it to "output { stdout { codec => rubydebug } }" or paste an event from the JSON tab in Kibana. And what do want to have happen? What defines "working"?

9

I am looking something like if the event has to be checked with two if conditions else it should be dropped. In my case the moment I remove else statement, I could see events related to 2 conditions in Elasticsearch but when I use else statement, I don't see any messages in Elasticsearch.(Input is from syslog server which continuously flow through udp input plugin )

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.