Adding fields depending on event message in Logstash not working Adding fields depending on event message in Logstash not working elasticsearch elasticsearch

Adding fields depending on event message in Logstash not working


I have solved the problem. I get the expected results with the following code in "logstash.conf":

input {   file {    path => "C:\xxx.log"  }}filter {  grok {    patterns_dir => "C:\elk\patterns"    match => [ "message", "%{ERROR1:error1}" ]    match => [ "message", "%{ERROR2:error2}" ]  }  if [message] =~ /error1_regex/ {    grok {        patterns_dir => "C:\elk\patterns"        match => [ "message", "%{ERROR1:error1}" ]    }    mutate {        add_field => [ "id_error", "1" ]        add_field => [ "descripcio", "Error1!" ]        remove_field => [ "message" ]        remove_field => [ "error1" ]    }  }  else if [message] =~ /error2_regex/ {    grok {        patterns_dir => "C:\elk\patterns"        match => [ "message", "%{ERROR2:error2}" ]    }    mutate {        add_field => [ "id_error", "2" ]        add_field => [ "descripcio", "Error2!" ]        remove_field => [ "message" ]        remove_field => [ "error2" ]    }  }  if ("_grokparsefailure" in [tags]) { drop {} }}output {  elasticsearch {    host => "localhost"    protocol => "http"    index => "xxx-%{+YYYY.MM.dd}"  }}