If Else condition based on input log lines in logstash

Elastic Stack Logstash
2

Hi @sudo-ranjith ,
You can use below code:

In first if condition you can use unique word which is present in all log line1 but not in log line2.

for else if condition you can use unique word which is present in all log line2 but not in log line1.

if "Application" in [message]  {
        drop { }
}
else if "Workflows" in [message]{
grok{
	match => { "message" => "%{WORD:Severity}","%{DATA:ThreadID}","%{DATA:date}","%{DATA:time}",,"%{GREEDYDATA:message}" }
}
}
1 Like