Logstash Filter Conditional Usage

Elastic Stack Logstash
1

I am trying to code my filter to drop an event when three specific fields contain the text "Other", but cant seem to get events actually to drop. Here is the statement I am using, do I have the syntax and format correct? If not, please let me know what I did wrong.

if [ua.device] == "Other" and [ua.name] == "Other" and [ua.os] == "Other" { drop { id=> "drop noisy EWS chatter" } }

2

[ua.device] references a field with a dot in its name. [ua][device] reference an object that contains a field called device. You most likely want the latter.

3

Awesome, that took care of it! Thanks for the consult!!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.