Processor in cascade

[franco.federico]

Hi all

I think to use processor, I'd like to know if it possible to do this

processors:
  - add_filed: 
    fields:
      name: "pippo","pluto","paperino"
processors:
- if:
contains:
  name: "pluto"
      then: 
       - add_tags
         tags: true
         target: "is_found"
      else: 
        - drop_event

Do you think that is a correct configuration? I'd like to improve this processor in cascade with if contains change contains with another condition in order to check a field in winlogbeat like this

- if:
contains:
  name: winlog.eventdata.user

Thank you
Franco

[andrewkroh]

Aside from some indentation issues, yes, you can nest if statements. If your logic is getting to complicated to be represented in YAML you could also try the script processor.

processors:
- script:
    lang: javascript
    id: my_filter
    source: >
      function process(event) {
          var name = event.Get("name");
          if (name === "pluto") {
              event.Tag("is_found");
          } else {
              event.Cancel();
          }
      }