If else condition with logstash filter

Elastic Stack Elasticsearch
1

Hi Folks,

I am trying to achive certain conditions with logstash and wondering \if - if-else statement or validation is possible in Logstash filter?

I have below messages in json and parsing DMARC logs with logstash. I wanted to achieve

if auth_spf == pass then insert Tag DMARC aligned True
OR
if auth_dkim == pass then insert Tag DMARC aligned True
OR
if auth_spf || auth_dkim == pass then insert Tag DMARC aligned True

Can someone please help?

2

Conditionals can be used to control which filter runs but not be used within filters.

3

Hmm..so where can I use those if-else conditions?

4

In the Logstash config file.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.