Logstash Filter - regez

Elastic Stack Logstash
1

Hi,

Please help me with the if condition filter in logstash for same KQL querymentioned below.
message: *.url.* and not *failover*

Below logstash filter is not working
filter{
if ([message] != ‘.\.url\..’ and [message] == ‘.failover.’)
{
grok{}
}
else{
drop{}
}
}

2

Use a substring match

if ".url." in [message] and "failover" not in [message] {
3

Thank you @Badger for your reply.

Can you please tell me how can I use .url. with wildcard on both ends?, like this *.url.* in KQL.

4

"something" in [message] is a substring match. It does not need wildcards at each end, they are implicit.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.