I want to put my grok inside if else block of logstash I want the fields to be displayed in kibana it's executing but not displaying the actual fields

Elastic Stack Logstash
1 
filter {
  if [IgmpSnooping] == "%IGMPSNOOPING-6-NO_IGMP_QUERIER" {
    grok { match => { "message" => "<%{INT:priority:int}>%{SYSLOGTIMESTAMP:timestamp}\s+%{HOSTNAME:device_name}\s+\IgmpSnooping:\s+%{DATA:IgmpSnooping}\:%{GREEDYDATA:message}" } }
  }
  else if [program] == "ConfigAgent" {
    grok { match => { "message" => "<%{POSINT:priority:int}>%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:device_name} %{WORD:program}: %{DATA:message} sourceIP : \(%{IP:source_ip}\)" } }
  }
  
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.