Logstash output condition to filter a string in syslog


I am new to ELK and trying to send syslogs based on a customer code to different ES indexes using Logstash.
I am trying following with no luck.

input {
udp {
type => syslogs
port => 5001
output {

  if [message] in "ABC"{
      elasticsearch {
            hosts => ["http://elasticsearch:9200"]
            index => "abc_index_%{+YYYY.MM.dd}"


Please kindly advice on the correct way of coding this in Logstash config pipe.


Actually I used "=~" instated of "in" and it worked.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.