Question
If I use this IF statement,
if ("FTNTFGTpolicyname" in [message]) or ("FTNTFGTlogid" in [message]) {, the CPU of the logstash server spikes to very high, pretty much forever.
If I change it to this, CPU is minimal.
if ([message] =~ "FTNTFGTpolicyname") or ([message] =~ "FTNTFGTlogid") {
So, what's the difference? Would you expect this difference to make a large CPU difference?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.