Logstash multiple expressions in a single condition

Elastic Stack Logstash
1

quick question:

Would this be the correct way to place multiple expressions in a single condition?

if [EMS_Identifier] == "monitor.globalStatus.nonCritical" and "disk" in [syslog_message] and "failed" in [syslog_message] {
mutate {
add_tag => ["RAID_Disk_FAILED"]
}
}

2

Yes, that looks okay.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.