How to parse a particular log file

Elastic Stack Logstash
1

So i have 2 log file say log1 and log2.I want to parse them using separate filter.

so can i use if statement on file source like

if [source] == ///log1 {
do something
}
else {
do something
}

2

Hi @anon69830709,

You can use it that is the right way and you can use like
if [source] == "log1"
{

}
else if [source] == "log2"
{

}
else { }

Thanks & Regards,
Krunal.

3

source is for file name or path?
When i mention source, do i need to specify file location?

4

Hi @anon69830709,

Sorry for late response,

Source is your field name like:

if [message] == "login failed"
{
kv{ }
grok{ } #what ever filter you want to apply you can use here in if else loop.
}
else if [192.168.1.1] == "login failed"
{
#you can use same here
}

Thanks & Regards,
Krunal.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.