I do have one more thing though. I am fixing bigger logstash config where I have custom grok patterns.
In Filebeat I have multiple log files and some of them are showing output in Kibana ok, and some not. I can suspect that it takes time for Filebeat to send stuff but just want to make sure if following is legit in logstash-config file.
if "something-1" in [tags] {
grok {
}
}
.
.
.
.
if "something-N" in [tags] {
grok {
}
}
I have this set multiple times i.e. I have multiple if conditions set like that. So, was wondering if that is ok by logstash or I should include else if as well?
Not sure how logstash checks multiple if statements, like programming or it checks them all and if they match I get output?