hi, im trying to filter my S3 logs and change Original value of the " cs_host " field to a different one, This is the filter block of my Logstash conf. But this isn't working. Please let me know whats wrong here.
filter {
grok {
match => { "message" => "%{S3_ACCESS_LOG}"}
}
date {
locale => "en"
match => ["timestamp", "d/MMM/YYYY:HH:mm:ss Z"]
}
if [cs_host] == "host1.example.com" {
mutate {
replace => [ "cs_host", "host1" ]
}
}
if [cs_host] == "host2.example.com" {
mutate {
replace => [ "cs_host", "host2" ]
}
}
}