Hi,
I'm using an IF statement with RegEx but it's never true and seems to skip the whole IF statement.
It doesn't get a far as "[message] =~ /(\QChanges\E)/" so I assume that probably doesn't work either as the first condition isn't met or wrong.
The part that isn't working is in Bold.
Please advise.
Thanks
Martin
example:
message string: "some text FIM more text"
filter {
if [type] == "acsc-main-alerts" {
mutate {
convert => { "eventtime" => "string" }
}
date {
match => [ "eventtime", "ISO8601" ]
remove_field => [ "eventtime" ]
}
if [message] =~ /\QFIM\E/ {
mutate {
add_field => { "severity" => "%{criticality}" }
}
if [message] =~ /(\QChanges\E)/ {
mutate {
add_field => { "acsctype" => "FIM Change" }
}
} else if [message] =~ /(\QErrors\E)/ {
mutate {
add_field => { "acsctype" => "FIM Error" }
}
}
}
}
}