Or condition doesn't work

Elastic Stack Logstash
1

Hello everybody,

I use logstash to parse these messages :

28/05/2018 16:01:06.716 (SERVICE) 29/05/2018/D T UE_TECXXX_J_TN_SSH005_LOG_PGAH8_SIGN(21863)/UE_TECXXX_X_LL_OPE003_TECHNIQUE PLA STATUS : PL Toutes les contraintes de planification de la localisation UE_TECXXX_X_LL_OPE003_TECHNIQUE de la tâche UE_TECXXX_J_TN_SSH005_LOG_PGAH8_SIGN sont réalisées
28/05/2018 16:02:34.076 (TACHE) 28/05/2018/D T OR_WKFXXX_J_TN_WKF997_PUB_TELE_OP(15519)/OR_XXXXXX_X_LL_POC001_PROTOPROD EXE STATUS : EX Ecriture d'un message de lancement de la procédure XX_XXXXXX_X_XX_DCK003_BATCH_LOCAL (AGENT) (REF=71858948,LAPSE=0) : LANPRO,TCH=15519,PROC=1932,VPROC=961000,DATE=20180528,MEX=P,TYPE=S,VEPROC=74339,EPROC=4,DHPROC=28052018160234,NOM=XX_XXXXXX_X_XX_DCK003_BATCH_LOCAL,VAR=O,NB=16,LOG=O
28/05/2018 16:02:35.510 (SERVICE) 28/05/2018/D V XX_XXXXXX_X_VA_XXX000_DATSYS(0)/ MSG STATUS : SL Début du traitement de l'action PVARTS venant du serveur LOCAL
28/05/2018 16:02:35.526 (SERVICE) 28/05/2018/D T OR_WKFXXX_J_TN_WKF997_PUB_TELE_OP(15519)/OR_XXXXXX_X_LL_POC001_PROTOPROD TAC STATUS : MV Modification de la variable XX_XXXXXX_X_VA_XXX000_DATSYS : nouvelle valeur : 20180528-20180528-1602.log (N° 1)
28/05/2018 16:02:35.526 (SERVICE) 28/05/2018/D V XX_XXXXXX_X_VA_XXX000_DATSYS(40)/DEFAUT MSG STATUS : SL Fin du traitement de l'action PVARTS venant du serveur LOCAL
28/05/2018 16:02:43.186 (EXTERNE) 28/05/2018/D T OR_WKFXXX_J_TN_WKF997_PUB_TELE_OP(15519)/OR_XXXXXX_X_LL_POC001_PROTOPROD DEB STATUS : EC La tâche est en exécution sur l'agent XX_XXXXXX_X_AG_LIN001_LRDOCORSEDT1 (2126) : LANPRO N° 71858948, ATTENTE DE 9 seconde(s)
28/05/2018 16:03:01.100 (EXTERNE) 28/05/2018/D T OR_WKFXXX_J_TN_WKF997_PUB_TELE_OP(15519)/OR_XXXXXX_X_LL_POC001_PROTOPROD FIN STATUS : EC La tâche se termine : réception d'une fin de procédure (STS=OK,EXIT=0,MSG=ARRET_NORMAL_PAR_EXIT(000),LAPSE=21,CP=1,IO=8,LOG=O,TRF=N)
28/05/2018 16:03:04.156 (TACHE) 28/05/2018/D T OR_WKFXXX_J_TN_WKF997_PUB_TELE_OP(15519)/OR_XXXXXX_X_LL_POC001_PROTOPROD TER STATUS : TN Terminaison normale de la tâche (TN EXIT CODE 0)
28/05/2018 16:03:04.203 (TACHE) 28/05/2018/D T OR_WKFXXX_J_TN_WKF998MT_CALC_STAT_JOUR(15805)/OR_XXXXXX_X_LL_POC001_PROTOPROD EXP STATUS : AC Mise en attente de prédécesseur de la tâche : 1

I would like to drop any sentences that do not contain "CODE" or "réalisées"

I can have only "non CODE" sentences with :

if [message] !~ "CODE"
  {
    drop { }
  }

I can also have only "non réalisées" sentences with :

if [message] !~ "réalisées"
  {
    drop { }
  }

But when I want to merge these two conditions with :

if [message] !~ "réalisées" or [message] !~ "CODE"
  {
    drop { }
  }

It doesn't work and logstash drop every messages

That's why I think my IF condition is false but I can't understand why

Can somebody help me ?

Thx for all

2

I found my mistake, I replace "or" by "and", and now it works..

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.