Logstash filter combine

[VamPikmin]

Is it possible to use match and mutate in the same filter?

Message is in the following format:

<164>%ASA-4-722051: Group <DfltGrpPolicy> User <test_user> IP <test_ip> IPv4 Address <test_ip> IPv6 address <::> assigned to session

filter {
               if [type] == "cisco-asa" and "ASA-4-722051" in [message] {
               grok {
               match => {
               "message" => "<164>%ASA-4-722051: Group <%{USERNAME:Group}> User <%{NOTSPACE:Username}> IP <%{IP:client_ip}> IPv4 Address <%{IP:client_vpn}> IPv6 address <%{IP:client_vpn_IPv6}> assigned to session"
               }}}}

filter {
       if [type] == "cisco-asa" and "ASA-4-722051" in [message] {
       mutate { remove_field => ["client_vpn_IPv6"] }
       }}

Thanks

[Badger]

@VamPikmin

Is it possible to use match and mutate in the same filter?

A filter {} section can contain pretty much any number and variety of filters. So the answer is yes.

[VamPikmin]

Thanks @Badger

I was trying to use the mutate filter inside grok...