Logstash filter conditional if tags or

Elastic Stack Logstash
1

Am i doing something wrong here ?

Logs with tag dcsaghosts are the ones only processed by the filter and ignoring the logs with tag pcwsaghosts

filter {
if "dcsaghosts" in [tags] or "pcwsaghosts" in [tags] {
if "dc-itpag-idm" in [tags] or "pcw-itpag-idm" in [tags] {
grok {
match => { "message" => "- %{IPV4:clientip} - - [%{HTTPDATE:requesttimestamp}] %{WORD:httpmethod} / %{NUMBER:responsecode:int} %{NUMBER:responsesize:int} - - - %{NUMBER:responsetimems:int}" }
}
}
else if "dc-sspag-idm" in [tags] or "pcw-sspag-idm" in [tags] {
grok {
match => { "message" => "%{IPV4:clientip} - - [%{HTTPDATE:requesttimestamp}] "%{WORD:httpmethod} /" %{NUMBER:responsecode:int} %{NUMBER:responsesize:int} "-" "-" "-" "%{NUMBER:responsetimems:float}""}
}
}
}

    date {
            locale => "en"
            timezone => "America/New_York"
            match => [ "requesttimestamp","dd/MMM/yyyy:HH:mm:ss Z" ]
    }

}

2

Please show an event that hasn't been correctly processed. Use a stdout { codec => rubydebug } output so we can see what it looks like after Logstash has processed it.

3

Thanks. Issue on my side config typos in one of filebeat with tags pcwsaghosts

Resolved. IF condition is working fine.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.