How to put condition based on certain string in [message]?

Elastic Stack Logstash
1

Hi,

I am trying to apply grok only if message has certain string. For example my message has source_type=\"APP/PROC/WEB\" and my config looks like,

if "source_type=\"APP" in [message]{
do something
}

Condition is not working at all. Please help me to use condition to check above mentioned string in [message]

Thanks

2

The syntax is incorrect. Usually this one is used to check if a string is in an array field like if "_grokparsefailure" in [tags]. In your case you can use regex as in Logstash if statement with regex example

3

Hi,

I didn't clearly understand what you mean. This explains what I am using is correct.

if "hello" in [greeting] {
    mutate { add_tag => "string in field" }
  }

I am using something like above.

4

I see, I guess because your search string contains double quotes. Have you given regex a try? It should work properly.

5

https://www.elastic.co/guide/en/logstash/master/config-examples.html#using-conditionals

6

What do you mean by regex here? I am not matching for a word or an integer but a particular string.

7

I mean your search string source_type=\"APP/PROC/WEB\" may have special characters that don't work in the normal in syntax.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.