IF condition on the beginning of a log line

Hi all :),

Happy to be new to ELK. ( 2 days :stuck_out_tongue: )
I would like to know how to make a condition on the beginnig of a log line.

For exemple :
This is my log :
2017-05-31 12:09:50,070 10885 INFO openstack_auth.views Logging out user "admin".

I have already parsed my log file, and i collect just the log message ("Logging out user "admin".") in LOGMESSAGE variable and i would like to make a condition like this :

if [module] == "openstack_auth.forms" AND "LOGMESSAGE BEGIN BY WORD Logging"
// My code

I don't know how to realize the { AND "LOGMESSAGE BEGIN BY WORD Logging" } condition...

Can someone tell me how to do ?

Thx for your help :slight_smile:

Hi @Ksugiu

If, as you say, you have saved the:-

Logging out user "admin"

String into a field named "logmessage", then you could do something like:-

if [module] == "openstack_auth_forms" and [logmessage] =~ /^Logging.*/ {

   <do stuff>


Hi Kryten,

Thx for your reply.
It's exactlly what i was looking for :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.