Which one is correct:
filter {
if [kubernetes_labels][app] == "app-name" and [kubernetes_container_name] == "nginx" {
grok {
match => {"message" => 'XXX'}}}
else if [kubernetes_labels][app] == "app-name" and [kubernetes_container_name] == "app" {
grok {
match => {"message" => "XXX"}}}
}
or
filter {
if [kubernetes_labels][app] == "app-name" {
if [kubernetes_container_name] == "nginx" {
grok {
match => {"message" => 'XXX'}}
}
else if [kubernetes_container_name] == "app" {
grok {
match => {"message" => "XXX"}}
}
}
}
or
filter {
if [kubernetes_labels][app] == "app-name" {
if [kubernetes_container_name] == "nginx" {
grok {
match => {"message" => 'XXX'}}
}
if [kubernetes_container_name] == "app" {
grok {
match => {"message" => "XXX"}}
}
}
}
I know case 1 works fine but am trying to fine tuning the filters and wanted to check with community.
There is no much documentation on if loops.
Please help. Thanks