If I have:
File A
filter {
if [app] == "app1" {
mutate {
add_field => { "type" => "type1" }
}
grok {
match => ["message", "this pattern matches my log file"]
}
}
}
File B
filter {
if [app] == "app2" {
mutate {
add_field => { "type" => "type1" }
}
grok {
match => ["message", "this pattern matches my log file"]
}
}
}
Will there be any issues with both of these having the same type, even though I first split them by a different "app" field value?