Hi all,
question: I want to use many if blocks:
is this statement ok or do I need always "else" to end the "if" expression?
if "Resource" in [Error_Code]{
mutate {add_tag => "Recource"}
}
else if "State" in [Error_Code]{
mutate {add_tag => "Channel_Error"}
}
else if "Key" in [Error_Code]{
mutate {add_tag => "LogError"}
}
else if "Missing" in [Error_Code]{
mutate {add_tag => "NiceError"}
}
next
if "Bla" in [Code]{
mutate {add_tag => "Bla"}
}
else if "Blub" in [Code]{
mutate {add_tag => "Blub"}
}
else if "Bal" in [Error_Code]{
mutate {add_tag => "Bal"}
}
else if "Blo" in [Error_Code]{
mutate {add_tag => "Blo"}
}
and so on
What I dont understand how to say if the field is empty:
if "" in [Error_Code]{
mutate {add_tag => "allgood"}
}
Further:
It is ok to just use "if" by "if" by "if" without having any "else if" nor "else" ?
Means how to say "if" ends here in right way?
Thanks in advance
Regards