Logstash is not splitting apache log fields

[mriggy]

Hello,

I am trying to parse apache access logs and assign a value to each field. The problem is that the whole message goes into the message field instead. Could you please help with parsing.

conf file:

filter {
  if [fields.apachetype] =~ "error" {
    grok {
      patterns_dir => [ "/etc/logstash/patterns.d" ]
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
  } else if [fields.apachetype] =~ "access" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
  }
}

[magnusbaeck (Magnus Bäck)]

[fields][apachetype], not [fields.apachetype]. See https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references.