Hey folks, I am a bit confused regarding use of if else constructs in logstash. I have the following config: filter { if "apache_access" in [tags] { grok { match => { "message" => "%{HTTPD_COMMONLOG}" } } } if "apache_error" in [tags] { grok { match => { "message…

Your else block is only connected to the second conditional. You need this: if ... { ... } else if ... { ... } else { ... }

Discuss the Elastic Stack

If/Else not working as expected in filter

Elastic Stack Logstash

va1entin (Valentin) April 16, 2018, 11:35am 3

Thank you very much, @magnusbaeck
That does exactly what I intended. I didn't know that the conditions have to connected like that.

Topic		Replies	Views
Logs that do not match the Filter with IF statement Logstash	6	3927	July 6, 2017
IS it possible to use "nested else if" in logstash.conf Logstash	3	290	January 31, 2023
If condition working but not else Logstash	6	1705	May 3, 2019
Some trouble with if / else in logstash filter block Logstash	3	1080	July 6, 2017
Logstash if else Logstash	8	1207	April 27, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

If/Else not working as expected in filter

Related topics