Hello,
I am trying create multiple if statements in the filter section in my pipeline config but I have no success with that.
This works (with one if statement)
filter {
json {
source => "message"
}
split { field => "[data][TABLE_neighbor][ROW_neighbor]" }
if "172.1.1.1" in [host] or "172.1.1.2" in [host] or "172.1.1.3" in [host] or "172.1.1.4" in [host] {
mutate {
add_tag => [ "test" ]
}
}
}
This doesn't work:
filter {
json {
source => "message"
}
split { field => "[data][TABLE_neighbor][ROW_neighbor]" }
if "172.1.1.1" in [host] or "172.1.1.2" in [host] or "172.1.1.3" in [host] or "172.1.1.4" in [host] {
mutate {
add_tag => [ "test" ]
}
}
if "true" in [data.TABLE_neighbor.ROW_neighbor.up] {
mutate {
add_field => { "testfield" => "1" }
}
}
}
What wrong with this filter? How can I use multiple if statements for different fields?
Regards,
Robin