How to put condition based on certain string in [message]?


I am trying to apply grok only if message has certain string. For example my message has source_type=\"APP/PROC/WEB\" and my config looks like,

if "source_type=\"APP" in [message]{
do something

Condition is not working at all. Please help me to use condition to check above mentioned string in [message]


The syntax is incorrect. Usually this one is used to check if a string is in an array field like if "_grokparsefailure" in [tags]. In your case you can use regex as in Logstash if statement with regex example


I didn't clearly understand what you mean. This explains what I am using is correct.

if "hello" in [greeting] {
    mutate { add_tag => "string in field" }

I am using something like above.

I see, I guess because your search string contains double quotes. Have you given regex a try? It should work properly.

What do you mean by regex here? I am not matching for a word or an integer but a particular string.

I mean your search string source_type=\"APP/PROC/WEB\" may have special characters that don't work in the normal in syntax.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.