Logstash Filter If loop

[adityak248 (Karthik)]

Which one is correct:

filter {
    if [kubernetes_labels][app] == "app-name" and [kubernetes_container_name] == "nginx" {
        grok {
            match => {"message" => 'XXX'}}}
    else if [kubernetes_labels][app] == "app-name" and [kubernetes_container_name] == "app" {
        grok {
            match => {"message" => "XXX"}}}
}

or

filter {
    if [kubernetes_labels][app] == "app-name" {
        if [kubernetes_container_name] == "nginx" {
            grok {
                match => {"message" => 'XXX'}}
        }
        else if [kubernetes_container_name] == "app" { 
            grok {
                match => {"message" => "XXX"}}
        }
    }
}

or

filter {
    if [kubernetes_labels][app] == "app-name" {
        if [kubernetes_container_name] == "nginx" {
            grok {
                match => {"message" => 'XXX'}}
        }
        if [kubernetes_container_name] == "app" {
            grok {
                match => {"message" => "XXX"}}
        }
    }
}

I know case 1 works fine but am trying to fine tuning the filters and wanted to check with community.
There is no much documentation on if loops.
Please help. Thanks

[leandrojmp (Leandro Pereira)]

All of them are correct and will work, which one is better depend users preference.

All the documentation needed for if conditionals in Logstash is here.