Logstash if statement not working probably

[davinders (davinder singh)]

Continuing the discussion from Grok filter if condition issue:

@magnusbaeck

This isn't a grok question, it's a general filter question. This is probably what you're looking for:

filter {
  ...
  if "method" in [tags] {
    mutate {
      add_tag => ["newtag", "manualtag"]
    }
  }
}

Continuing the discussion from Grok filter if condition issue:

@magnusbaeck

This isn't a grok question, it's a general filter question. This is probably what you're looking for:

filter {
  ...
  if "method" in [tags] {
    mutate {
      add_tag => ["newtag", "manualtag"]
    }
  }
}

I am trying to restrict content/data to go to Elasticsearch if grok not able to parse data in input.log but seems if "_grokparsefailure" not in [tags] not working. I am parsing some input log and matching some pattern using grok. If grok does not find a match, this match is still going to output and I can see unmatched (_grokparsefailure) text in tags in Elasticsearch indexed docs. So i don't want any data to be passed to Elasticsearch if grok pattern fails. Hope my question is clear.

My logstash.conf file.
input {
file {
path => "/opt/elasticSearch/logstash-1.4.2/input.log"
codec => multiline {
pattern => "^["
negate => true
what => previous
}
start_position => "end"
}
}

filter {
grok {
match => [
"message", "^[%{GREEDYDATA}] %{GREEDYDATA} Searching hotels for country %{GREEDYDATA:country}, city %{GREEDYDATA:city}, checkin %{GREEDYDATA:checkin}, checkout %{GREEDYDATA:checkout}, roomstay %{GREEDYDATA:roomstay}, No. of hotels returned is %{NUMBER:hotelcount} ."
]
}
}

output {

    if "_grokparsefailure" not in [tags]{
            elasticsearch {
                    cluster => "elasticsearchdev"
            }
    }

}

[warkolm (Mark Walkom)]

I'll close this one as you also have Logstash if statement not working correctly