Wrapping your filter logic in conditional expressions can be very important.
If your configuration is split up into many files, logstash will combine and run all of the stanzas. Also, using conditionals to limit the amount of processing performed will make this step faster.
To tell if an event contains a given tag:
if "value" in [tags] {
}
For string fields:
if [FIELD] =~ /.+/ {
# exists
}
if [FIELD] !~ /.+/ {
# doesn't exist
}
For numeric fields:
if [FIELD] {
# exists
}
How do you combine following if conditions?
e.g.
if “INFO” in [message] { match 1 } OR
if “DEBUG” in [message] { match 1 again }
I tried
if “INFO” in [message] or “DEBUG” in [message]
Did not worked.
“in” is really for tags.
For fields, try this:
if [field] == "value1" or [field] == "value2" {....
}