Logstash If statement and grok not working

Elastic Stack Logstash
1

I am using following if statement, not sure what is wrong here, it is giving me _mutate_error.
Does the / cause this error?

if [operationName] == "MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE"
        {
            mutate {
                add_field => { "Signal" => "A resource group deletion operation has %{[resultSignature]} by the user %{[identity][claims]http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress]}"}
		add_field => { "Priority" => "HIGH"}
                add_field => { "category" => "Resource"}
            }
        }

Also, getting _grokparsefailurein tag, grok filter is as follows :

if "RESOURCEGROUPS" in [resourceId]
{
                grok
                {
                match => {"[resourceId]" => ".*resourceGroups/%{USERNAME:resourceGroupName}.*"}
                }
                
}

Can anyone help ?

2 
%{[identity][claims]http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress]}

That is not a valid field reference.

What does the [resourceId] field look like?

grok patterns are not anchored, so the .* at the start and end are not needed.

1 Like
3

@Badger thanks for getting back.

resourceId data is as follows:
/SUBSCRIPTIONS/AC015FE2-22FA-4D11-8E84-275FE7123A28/RESOURCEGROUPS/TEST

4

I got it !
I was searching for resourceGroups in grok but it is in caps RESOURCEGROUPS I changed grok pattern to .*RESOURCEGROUPS/%{USERNAME:resourceGroupName}.* and now it is working.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.