Skip to end of filter if the grok pattern does not match

Elastic Stack Logstash
1

Is there a option for a filter so that when the grok pattern does not match skip all the other filter plugins and leave the filter?

Ideal situation is if the grok pattern does not match

  1. skip the rest of the filter plugins (mutate, gsub, kv, etc)
  2. dont tag the event with "_grokparsefailure"

Thank you

2

There is no goto or break in the logstash configuration language. What you would have to do is:

grok {}
if "_grokparsefailure" in [tags] {
     mutate { remove_tag => [ "_grokparsefailure" ] }
} else {
    mutate { ... }
    gsub { ... }
    kv { ... }
}
3

Thank you @Badger

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.