Tag events based in words in different fields

Elastic Stack Logstash
1

Hello everybody,

I want to make a better code, but i try a lot of thing and nothing works.
I need to tag the input based in many words in 4 different fields.

Im doing like this, but need to replicate all the filter for a new field, like [oldtext].

Someone can help?

filter {
     if 
	"word1" in [text] or
	"word2" in [text] or
	"word3" in [text] or
	"word4" in [text] or
	"another word" in [text]
	
	{
          mutate { add_tag => "newtag" }
     }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.