Adding fields depending on event message in Logstash not working
I have solved the problem. I get the expected results with the following code in "logstash.conf":
input { file { path => "C:\xxx.log" }}filter { grok { patterns_dir => "C:\elk\patterns" match => [ "message", "%{ERROR1:error1}" ] match => [ "message", "%{ERROR2:error2}" ] } if [message] =~ /error1_regex/ { grok { patterns_dir => "C:\elk\patterns" match => [ "message", "%{ERROR1:error1}" ] } mutate { add_field => [ "id_error", "1" ] add_field => [ "descripcio", "Error1!" ] remove_field => [ "message" ] remove_field => [ "error1" ] } } else if [message] =~ /error2_regex/ { grok { patterns_dir => "C:\elk\patterns" match => [ "message", "%{ERROR2:error2}" ] } mutate { add_field => [ "id_error", "2" ] add_field => [ "descripcio", "Error2!" ] remove_field => [ "message" ] remove_field => [ "error2" ] } } if ("_grokparsefailure" in [tags]) { drop {} }}output { elasticsearch { host => "localhost" protocol => "http" index => "xxx-%{+YYYY.MM.dd}" }}