Logstash Filter - regez

[jancodenew (jan)]

Hi,

Please help me with the if condition filter in logstash for same KQL querymentioned below.
message: *.url.* and not *failover*

Below logstash filter is not working
filter{
if ([message] != ‘.\.url\..’ and [message] == ‘.failover.’)
{
grok{}
}
else{
drop{}
}
}

[Badger]

Use a substring match

if ".url." in [message] and "failover" not in [message] {

[jancodenew (jan)]

Thank you @Badger for your reply.

Can you please tell me how can I use .url. with wildcard on both ends?, like this *.url.* in KQL.

[Badger]

"something" in [message] is a substring match. It does not need wildcards at each end, they are implicit.