IF Statement being ignored


I have a (simplified) filter rule like:

filter {
    if "" or "" or "" in [host] {
        grok {
            match => { "message" => [
                '^Accepted keyboard-interactive/pam for %{USERNAME:username} from %{IP:src_ip} port %{POSINT:src_port}' ] }
        mutate {
            add_tag => [ "hardware" ]

But for some reason logstash tags all events with the tag "hardware" EVEN if they are not listed as a host in "" or "" or "".

Why is this happening? It's like the 'IF' statement is not being honored.

Any ideas on how to tag the messages only for the required hosts?


if "" or "" or "" in [host] {

Natural language doesn't always translate into if expressions. This expression probably means "if is a non-empty string (which is always is) or is a non-empty string (which is always is) or is a substring of the contents of the host field". This is what you're looking for:

 if [host] in ["", "", ""]  {
1 Like

That was fast!
Thanks very much - That would also explain why I getting grokparsefailures from other rules that arent matching correctly!
Thanks again

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.